{"id":"CVE-2026-80855","title":"fuse: fix invalidate lock leak on open O_TRUNC DAX failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix invalidate lock leak on open O_TRUNC DAX failure\n\nfuse_open() takes filemap_invalidate_lock() for a DAX truncate\n(dax_truncate = true) and releases it before …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d58366aab86854217b81679d1a9dcd54a2edfc2a < 1b04d80a27d317064cce2307472f5bef9975bc50","Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < a61524da59a2f5ac9c8de23ff98b30da769ab144","Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010","Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 7288c279ddbd654a06c82118c1a3f5570c1807f0","Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 776e85fda752f9a15e0f82dec42ecacd12a9bd94","Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da","Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < e981474d7bf1457da12404e169ea147d2c8ecea7","Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < a927f1867e61b78f39f9da0bbba3c98c2ca151fe","Linux 81775ab858b4236c52c5da7e25cec6e49dd91b46","Linux b57e150ac2eac791d5d187923b73dc2dafaf67fa","Linux 1fdbbe246daf348adaa0739463384b16ceba1fc0","Linux >= 5.15.109 < 5.15.220","Linux >= 5.10.179 < 5.11","Linux >= 5.18.18 < 5.19","Linux >= 5.19.2 < 5.20","Linux 6.0"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:49.307Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80855","references":[{"url":"https://git.kernel.org/stable/c/1b04d80a27d317064cce2307472f5bef9975bc50"},{"url":"https://git.kernel.org/stable/c/a61524da59a2f5ac9c8de23ff98b30da769ab144"},{"url":"https://git.kernel.org/stable/c/dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010"},{"url":"https://git.kernel.org/stable/c/7288c279ddbd654a06c82118c1a3f5570c1807f0"},{"url":"https://git.kernel.org/stable/c/776e85fda752f9a15e0f82dec42ecacd12a9bd94"},{"url":"https://git.kernel.org/stable/c/1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da"},{"url":"https://git.kernel.org/stable/c/e981474d7bf1457da12404e169ea147d2c8ecea7"},{"url":"https://git.kernel.org/stable/c/a927f1867e61b78f39f9da0bbba3c98c2ca151fe"}],"tags":["cve.org"],"epss":0.00165,"epssPercentile":0.05308,"ingestedAt":"2026-10-19T09:16:01.493Z","slug":"CVE-2026-80855","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix invalidate lock leak on open O_TRUNC DAX failure\n\nfuse_open() takes filemap_invalidate_lock() for a DAX truncate\n(dax_truncate = true) and releases it before the out_inode_unlock\nlabel.  But when fuse_dax_break_layouts() fails, the goto\nout_inode_unlock skips the unlock and leaks the rwsem, so any later\nfault or truncate on the file stalls on the stale lock.\n\nfuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal\ninterrupts the wait for busy DAX pages to drain:\n\n  open(\"file\", O_RDWR | O_TRUNC)\n  └─ fuse_open()\n     ├─ filemap_invalidate_lock()        # dax_truncate\n     └─ fuse_dax_break_layouts()\n        └─ dax_break_layout()\n           └─ wait_page_idle()           # TASK_INTERRUPTIBLE\n              └─ fuse_wait_dax_page()    # unlock, schedule, re-lock\n                 └─ signal → -ERESTARTSYS\n     goto out_inode_unlock               # <- lock leaked\n\nFix this by moving filemap_invalidate_unlock() below the label so\nthat all error paths release the lock, and rename the label to\nout_unlock as it now covers more than just the inode lock.\n\n## Affected\n\n- `Linux >= d58366aab86854217b81679d1a9dcd54a2edfc2a < 1b04d80a27d317064cce2307472f5bef9975bc50`\n- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < a61524da59a2f5ac9c8de23ff98b30da769ab144`\n- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010`\n- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 7288c279ddbd654a06c82118c1a3f5570c1807f0`\n- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 776e85fda752f9a15e0f82dec42ecacd12a9bd94`\n- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da`\n- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < e981474d7bf1457da12404e169ea147d2c8ecea7`\n- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < a927f1867e61b78f39f9da0bbba3c98c2ca151fe`\n- `Linux 81775ab858b4236c52c5da7e25cec6e49dd91b46`\n- `Linux b57e150ac2eac791d5d187923b73dc2dafaf67fa`\n- `Linux 1fdbbe246daf348adaa0739463384b16ceba1fc0`\n- `Linux >= 5.15.109 < 5.15.220`\n- `Linux >= 5.10.179 < 5.11`\n- `Linux >= 5.18.18 < 5.19`\n- `Linux >= 5.19.2 < 5.20`\n- `Linux 6.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}