CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure

Published Sep 4, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on open OTRUNC DAX failure

fuseopen() takes filemapinvalidatelock() for a DAX truncate (daxtruncate = true) and releases it before the outinodeunlock label. But when fusedaxbreaklayouts() fails, the goto outinodeunlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock.

fusedaxbreaklayouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain:

open("file", ORDWR | OTRUNC) └─ fuseopen() ├─ filemapinvalidatelock() # daxtruncate └─ fusedaxbreaklayouts() └─ daxbreaklayout() └─ waitpageidle() # TASKINTERRUPTIBLE └─ fusewaitdaxpage() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto outinodeunlock # <- lock leaked

Fix this by moving filemapinvalidateunlock() below the label so that all error paths release the lock, and rename the label to outunlock as it now covers more than just the inode lock.

Event History

Sep 4, 2026
CVE Published
via MITRE·03:55 PM
Data Sourced
via MITRE·03:55 PM
Description

Frequently Asked Questions

1

What conditions are required to trigger the lock leak?

The affected path requires a FUSE file using DAX to be opened with O_RDWR and O_TRUNC. During that open, fuse_dax_break_layouts() must fail, such as when a signal interrupts its wait for busy DAX pages to drain and it returns -ERESTARTSYS.

2

What is the operational impact after the failure occurs?

The filemap invalidate rwsem remains locked. Later page faults or truncate operations on the same file can stall while waiting on the stale lock.

3

How can an administrator recognize that this issue may have occurred?

A likely indicator is that a FUSE DAX file has a stalled fault or truncate after an interrupted O_TRUNC open operation. The triggering failure involves a signal interrupting the wait for busy DAX pages to become idle.

4

What does the available fix change?

The fix moves filemap_invalidate_unlock() below the shared error label, ensuring the invalidate lock is released on error paths including failure from fuse_dax_break_layouts().

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203