Linux kernel FUSE: interrupted DAX truncate on O_TRUNC open leaks the invalidate lock, wedging the file

Impact

On a FUSE mount with DAX enabled (in practice virtiofs with a DAX window), opening a file with O_TRUNC takes filemap_invalidate_lock() and then calls fuse_dax_break_layouts(). If that call fails - it returns -ERESTARTSYS when a signal arrives while waiting for busy DAX pages to drain - the error path jumps past the unlock and leaks the rwsem permanently. Every later page fault or truncate against that inode blocks forever on a lock nobody holds, so the task hangs in uninterruptible sleep and the file cannot be recovered without tearing down the mount. On a GPU node that serves datasets or model weights over virtiofs-DAX into guests or containers, one unprivileged local caller can strand a shared file and any job that touches it, and the wedged tasks make the node expensive to drain cleanly.

Who can reach it

Local unprivileged user on a host or guest with a DAX-enabled FUSE/virtiofs mount. No authentication beyond ordinary filesystem access: the caller opens a file with O_TRUNC and takes a signal during the DAX page-drain wait. Not reachable remotely and not reachable at all on nodes without FUSE DAX.

What to do

Update to a stable kernel carrying the fix (commits linked below move filemap_invalidate_unlock() below the shared error label) and reboot the node; the leak is in resident kernel code, so a running node stays exposed until it restarts. If a maintenance window is not available yet, the exposure disappears on mounts that do not enable the FUSE DAX window - check whether virtiofs is mounted with DAX before scheduling. No vendor advisory beyond the kernel commits accompanies this record.

References

Related entries

• Linux kernel FUSE: setattr writeback failure leaks the invalidate lock on a DAX truncateCVE-2026-80856 · Linux kernel FUSE (DAX truncate path in fuse_do_setattr)Unscored
• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel FUSE: io_uring queues published without release ordering can be read half-initializedCVE-2026-80858 · Linux kernel FUSE (io_uring queue publication ordering)Unscored
• Linux kernel FUSE: missing read barrier in the io-uring readiness check can reintroduce a lock-order deadlockCVE-2026-80859 · Linux kernel FUSE (fuse-over-io-uring readiness check in fuse_block_alloc)Unscored
• Linux kernel FUSE: race between request interrupt and resend leaves a request queued on the interrupt listCVE-2026-80860 · Linux kernel FUSE (interrupt vs. resend request handling)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored