{"id":"CVE-2026-80856","title":"fuse: fix invalidate lock leak on setattr writeback failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix invalidate lock leak on setattr writeback failure\n\nfuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate\n(fault_blocked = true) and releases it…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 8f14906ce9103ab8f2f1ebda45935a0d61b9d763","Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 03cfeeb135428fa83f0791d3f8f94d9298cae695","Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 92588d187ba4697a322e7aefe5d9e538a87d1cd2","Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < ea9fea370b8de4ffd72e0ef89550415c15637787","Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 1758730d9eaa3c06cf415c3446d9f6eed9ed3eed","Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < dd278d954c0e96a9cbd3cc491e07b8267d25f8d5","Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < e8457ebfd77a46e8d1210e8888ea914ad064558e","Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 9afeca0d569c9fc89d758fe7a9339d1e8afb1546","Linux 5.10"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:50.272Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80856","references":[{"url":"https://git.kernel.org/stable/c/8f14906ce9103ab8f2f1ebda45935a0d61b9d763"},{"url":"https://git.kernel.org/stable/c/03cfeeb135428fa83f0791d3f8f94d9298cae695"},{"url":"https://git.kernel.org/stable/c/92588d187ba4697a322e7aefe5d9e538a87d1cd2"},{"url":"https://git.kernel.org/stable/c/ea9fea370b8de4ffd72e0ef89550415c15637787"},{"url":"https://git.kernel.org/stable/c/1758730d9eaa3c06cf415c3446d9f6eed9ed3eed"},{"url":"https://git.kernel.org/stable/c/dd278d954c0e96a9cbd3cc491e07b8267d25f8d5"},{"url":"https://git.kernel.org/stable/c/e8457ebfd77a46e8d1210e8888ea914ad064558e"},{"url":"https://git.kernel.org/stable/c/9afeca0d569c9fc89d758fe7a9339d1e8afb1546"}],"tags":["cve.org"],"epss":0.00165,"epssPercentile":0.0531,"ingestedAt":"2026-10-19T09:16:01.493Z","slug":"CVE-2026-80856","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix invalidate lock leak on setattr writeback failure\n\nfuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate\n(fault_blocked = true) and releases it at the out:/error: labels.  But\nwhen a writeback flush is also needed, a write_inode_now() failure\nreturns directly and leaks the lock, so any later fault or truncate on\nthe file stalls on the stale rwsem.\n\nFor example, truncate(2) on a setuid file reaches fuse_do_setattr()\nwith both ATTR_SIZE and ATTR_MODE set:\n\n  truncate(2)\n  └─ do_truncate()\n     ├─ dentry_needs_remove_privs()         # S_ISUID\n     └─ notify_change()                     # KILL_SUID -> ATTR_MODE\n        └─ fuse_setattr()                   # no killpriv:\n           │                                #   ia_valid |= ATTR_MODE\n           └─ fuse_do_setattr()\n              ├─ filemap_invalidate_lock()  # IS_DAX && is_truncate\n              └─ write_inode_now()          # is_wb && ATTR_MODE\n                 └─ if (err)                # e.g. daemon -> -EIO\n                    return err              # <- lock leaked\n\nFix this by adding an unlock label that releases the lock before\nreturning the error, and use it for the fuse_dax_break_layouts()\nfailure path as well.\n\n## Affected\n\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 8f14906ce9103ab8f2f1ebda45935a0d61b9d763`\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 03cfeeb135428fa83f0791d3f8f94d9298cae695`\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 92588d187ba4697a322e7aefe5d9e538a87d1cd2`\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < ea9fea370b8de4ffd72e0ef89550415c15637787`\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 1758730d9eaa3c06cf415c3446d9f6eed9ed3eed`\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < dd278d954c0e96a9cbd3cc491e07b8267d25f8d5`\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < e8457ebfd77a46e8d1210e8888ea914ad064558e`\n- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 9afeca0d569c9fc89d758fe7a9339d1e8afb1546`\n- `Linux 5.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}