Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-80855

fuse: fix invalidate lock leak on open O_TRUNC DAX failure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open O_TRUNC DAX failure fuse_open() takes filemap_invalidate_lock() for a DAX truncate (dax_truncate = true) and releases it before the out_inode_unlock label. But when fuse_dax_break_layouts() fails, the goto out_inode_unlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock. fuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain: open("file", O_RDWR | O_TRUNC) └─ fuse_open() ├─ filemap_invalidate_lock() # dax_truncate └─ fuse_dax_break_layouts() └─ dax_break_layout() └─ wait_page_idle() # TASK_INTERRUPTIBLE └─ fuse_wait_dax_page() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto out_inode_unlock # <- lock leaked Fix this by moving filemap_invalidate_unlock() below the label so that all error paths release the lock, and rename the label to out_unlock as it now covers more than just the inode lock.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 81775ab858b4236c52c5da7e25cec6e49dd91b46 to < 69a294e561c10909688bcb25456535dcd1818e1aaffected
  • d58366aab86854217b81679d1a9dcd54a2edfc2a to < 1b04d80a27d317064cce2307472f5bef9975bc50affected
  • 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b to < a61524da59a2f5ac9c8de23ff98b30da769ab144affected
  • 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b to < dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010affected
  • 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b to < 7288c279ddbd654a06c82118c1a3f5570c1807f0affected
  • 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b to < 776e85fda752f9a15e0f82dec42ecacd12a9bd94affected
  • 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b to < 1d3e701cda2f41d48aa721b3ebefbe0fbf8d74daaffected
  • 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b to < e981474d7bf1457da12404e169ea147d2c8ecea7affected
  • 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b to < a927f1867e61b78f39f9da0bbba3c98c2ca151feaffected
  • b57e150ac2eac791d5d187923b73dc2dafaf67faaffected
  • 1fdbbe246daf348adaa0739463384b16ceba1fc0affected
  • 5.10.179 to < 5.10.273affected
  • 5.15.109 to < 5.15.220affected
  • 5.18.18 to < 5.19affected
  • 5.19.2 to < 5.20affected

Linux Linux

Default version status: affected

  • 6.0affected
  • 0 to < 6.0unaffected
  • 5.10.273 to ≤ 5.10.*unaffected
  • 5.15.220 to ≤ 5.15.*unaffected
  • 6.1.187 to ≤ 6.1.*unaffected
  • 6.6.156 to ≤ 6.6.*unaffected
  • 6.12.108 to ≤ 6.12.*unaffected
  • 6.18.49 to ≤ 6.18.*unaffected
  • 7.1.13 to ≤ 7.1.*unaffected
  • 7.2.3 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References