---
id: CVE-2026-80856
title: 'fuse: fix invalidate lock leak on setattr writeback failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: fix invalidate lock leak on setattr writeback failure

  fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate
  (fault_blocked = true) and releases it…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    8f14906ce9103ab8f2f1ebda45935a0d61b9d763
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    03cfeeb135428fa83f0791d3f8f94d9298cae695
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    92588d187ba4697a322e7aefe5d9e538a87d1cd2
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    ea9fea370b8de4ffd72e0ef89550415c15637787
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    1758730d9eaa3c06cf415c3446d9f6eed9ed3eed
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    dd278d954c0e96a9cbd3cc491e07b8267d25f8d5
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    e8457ebfd77a46e8d1210e8888ea914ad064558e
  - >-
    Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f <
    9afeca0d569c9fc89d758fe7a9339d1e8afb1546
  - Linux 5.10
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:50.272Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80856'
references:
  - url: 'https://git.kernel.org/stable/c/8f14906ce9103ab8f2f1ebda45935a0d61b9d763'
  - url: 'https://git.kernel.org/stable/c/03cfeeb135428fa83f0791d3f8f94d9298cae695'
  - url: 'https://git.kernel.org/stable/c/92588d187ba4697a322e7aefe5d9e538a87d1cd2'
  - url: 'https://git.kernel.org/stable/c/ea9fea370b8de4ffd72e0ef89550415c15637787'
  - url: 'https://git.kernel.org/stable/c/1758730d9eaa3c06cf415c3446d9f6eed9ed3eed'
  - url: 'https://git.kernel.org/stable/c/dd278d954c0e96a9cbd3cc491e07b8267d25f8d5'
  - url: 'https://git.kernel.org/stable/c/e8457ebfd77a46e8d1210e8888ea914ad064558e'
  - url: 'https://git.kernel.org/stable/c/9afeca0d569c9fc89d758fe7a9339d1e8afb1546'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.0531
ingestedAt: '2026-10-19T09:16:01.493Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on setattr writeback failure

fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate
(fault_blocked = true) and releases it at the out:/error: labels.  But
when a writeback flush is also needed, a write_inode_now() failure
returns directly and leaks the lock, so any later fault or truncate on
the file stalls on the stale rwsem.

For example, truncate(2) on a setuid file reaches fuse_do_setattr()
with both ATTR_SIZE and ATTR_MODE set:

  truncate(2)
  └─ do_truncate()
     ├─ dentry_needs_remove_privs()         # S_ISUID
     └─ notify_change()                     # KILL_SUID -> ATTR_MODE
        └─ fuse_setattr()                   # no killpriv:
           │                                #   ia_valid |= ATTR_MODE
           └─ fuse_do_setattr()
              ├─ filemap_invalidate_lock()  # IS_DAX && is_truncate
              └─ write_inode_now()          # is_wb && ATTR_MODE
                 └─ if (err)                # e.g. daemon -> -EIO
                    return err              # <- lock leaked

Fix this by adding an unlock label that releases the lock before
returning the error, and use it for the fuse_dax_break_layouts()
failure path as well.

## Affected

- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 8f14906ce9103ab8f2f1ebda45935a0d61b9d763`
- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 03cfeeb135428fa83f0791d3f8f94d9298cae695`
- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 92588d187ba4697a322e7aefe5d9e538a87d1cd2`
- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < ea9fea370b8de4ffd72e0ef89550415c15637787`
- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 1758730d9eaa3c06cf415c3446d9f6eed9ed3eed`
- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < dd278d954c0e96a9cbd3cc491e07b8267d25f8d5`
- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < e8457ebfd77a46e8d1210e8888ea914ad064558e`
- `Linux >= 6ae330cad6ef22ab8347ea9e0707dc56a7c7363f < 9afeca0d569c9fc89d758fe7a9339d1e8afb1546`
- `Linux 5.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.