CVE-2026-90096: fuse: invalidate the correct range after O_APPEND direct write

In the Linux kernel, the following vulnerability has been resolved:

fuse: invalidate the correct range after OAPPEND direct write

fusedirectwriteiter() captures pos before genericwritechecks(), which moves kipos to EOF for OAPPEND writes:

fusedirectwriteiter() { pos = iocb->kipos; / 0 (user-supplied) / genericwritechecks(); / kipos -> EOF / fusedirectio(); / writes at EOF, correct / invalidate(pos, pos + res); / [0, res) -- wrong / }

The post-write invalidation targets a stale range instead of the actual written range at EOF.

This can cause data inconsistency when the file size is not page-aligned. The tail page straddling EOF has a valid portion before EOF that concurrent readers can fault back in during the DIO write window:

Tail page (file size X not page-aligned):

pagestart X (EOF) pageend |--- valid data ----|-- stale --|

CPU0 (OAPPEND DIO writer) CPU1 (buffered reader) -------------------------- ---------------------- invalidate [X, X+len) tail page evicted FUSEWRITE in flight ... read [pagestart, X) tail page re-faulted [X, pageend) = stale FUSEWRITE completes isize = X + len invalidate [0, len) <- WRONG tail page still cached read [X, X+len) hits stale tail page returns old data

Fix by reading pos back from iocb->kipos after genericwritechecks(), as genericfiledirectwrite() does.

Also fix a typo in the comment ("may have" -> "may have competed").