---
id: CVE-2026-80855
title: 'fuse: fix invalidate lock leak on open O_TRUNC DAX failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: fix invalidate lock leak on open O_TRUNC DAX failure

  fuse_open() takes filemap_invalidate_lock() for a DAX truncate
  (dax_truncate = true) and releases it before …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d58366aab86854217b81679d1a9dcd54a2edfc2a <
    1b04d80a27d317064cce2307472f5bef9975bc50
  - >-
    Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b <
    a61524da59a2f5ac9c8de23ff98b30da769ab144
  - >-
    Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b <
    dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010
  - >-
    Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b <
    7288c279ddbd654a06c82118c1a3f5570c1807f0
  - >-
    Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b <
    776e85fda752f9a15e0f82dec42ecacd12a9bd94
  - >-
    Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b <
    1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da
  - >-
    Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b <
    e981474d7bf1457da12404e169ea147d2c8ecea7
  - >-
    Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b <
    a927f1867e61b78f39f9da0bbba3c98c2ca151fe
  - Linux 81775ab858b4236c52c5da7e25cec6e49dd91b46
  - Linux b57e150ac2eac791d5d187923b73dc2dafaf67fa
  - Linux 1fdbbe246daf348adaa0739463384b16ceba1fc0
  - Linux >= 5.15.109 < 5.15.220
  - Linux >= 5.10.179 < 5.11
  - Linux >= 5.18.18 < 5.19
  - Linux >= 5.19.2 < 5.20
  - Linux 6.0
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:49.307Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80855'
references:
  - url: 'https://git.kernel.org/stable/c/1b04d80a27d317064cce2307472f5bef9975bc50'
  - url: 'https://git.kernel.org/stable/c/a61524da59a2f5ac9c8de23ff98b30da769ab144'
  - url: 'https://git.kernel.org/stable/c/dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010'
  - url: 'https://git.kernel.org/stable/c/7288c279ddbd654a06c82118c1a3f5570c1807f0'
  - url: 'https://git.kernel.org/stable/c/776e85fda752f9a15e0f82dec42ecacd12a9bd94'
  - url: 'https://git.kernel.org/stable/c/1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da'
  - url: 'https://git.kernel.org/stable/c/e981474d7bf1457da12404e169ea147d2c8ecea7'
  - url: 'https://git.kernel.org/stable/c/a927f1867e61b78f39f9da0bbba3c98c2ca151fe'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05308
ingestedAt: '2026-10-19T09:16:01.493Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on open O_TRUNC DAX failure

fuse_open() takes filemap_invalidate_lock() for a DAX truncate
(dax_truncate = true) and releases it before the out_inode_unlock
label.  But when fuse_dax_break_layouts() fails, the goto
out_inode_unlock skips the unlock and leaks the rwsem, so any later
fault or truncate on the file stalls on the stale lock.

fuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal
interrupts the wait for busy DAX pages to drain:

  open("file", O_RDWR | O_TRUNC)
  └─ fuse_open()
     ├─ filemap_invalidate_lock()        # dax_truncate
     └─ fuse_dax_break_layouts()
        └─ dax_break_layout()
           └─ wait_page_idle()           # TASK_INTERRUPTIBLE
              └─ fuse_wait_dax_page()    # unlock, schedule, re-lock
                 └─ signal → -ERESTARTSYS
     goto out_inode_unlock               # <- lock leaked

Fix this by moving filemap_invalidate_unlock() below the label so
that all error paths release the lock, and rename the label to
out_unlock as it now covers more than just the inode lock.

## Affected

- `Linux >= d58366aab86854217b81679d1a9dcd54a2edfc2a < 1b04d80a27d317064cce2307472f5bef9975bc50`
- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < a61524da59a2f5ac9c8de23ff98b30da769ab144`
- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010`
- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 7288c279ddbd654a06c82118c1a3f5570c1807f0`
- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 776e85fda752f9a15e0f82dec42ecacd12a9bd94`
- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < 1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da`
- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < e981474d7bf1457da12404e169ea147d2c8ecea7`
- `Linux >= 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b < a927f1867e61b78f39f9da0bbba3c98c2ca151fe`
- `Linux 81775ab858b4236c52c5da7e25cec6e49dd91b46`
- `Linux b57e150ac2eac791d5d187923b73dc2dafaf67fa`
- `Linux 1fdbbe246daf348adaa0739463384b16ceba1fc0`
- `Linux >= 5.15.109 < 5.15.220`
- `Linux >= 5.10.179 < 5.11`
- `Linux >= 5.18.18 < 5.19`
- `Linux >= 5.19.2 < 5.20`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.