Linux kernel FUSE: setattr writeback failure leaks the invalidate lock on a DAX truncate

Impact

A second lock leak in the same FUSE DAX truncate machinery, on a different path from CVE-2026-80855. fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate and normally drops it at the out:/error: labels, but when the request also needs a writeback flush and write_inode_now() fails - for example the FUSE daemon returns -EIO - the function returns directly and leaks the rwsem. The reachable trigger given in the record is truncate(2) on a setuid file, where privilege stripping adds ATTR_MODE alongside ATTR_SIZE. Afterwards every fault or truncate on that inode stalls forever, hanging the jobs that touch it and leaving uninterruptible tasks that make the node awkward to drain.

Who can reach it

Local unprivileged user on a host or guest with a DAX-enabled FUSE/virtiofs mount that also uses the writeback cache. The caller truncates a setuid file while the FUSE daemon returns a writeback error; no elevated privilege is needed. Nodes without FUSE DAX are unaffected.

What to do

Update to a stable kernel containing the fix (the linked commits add an unlock label covering the writeback-failure and fuse_dax_break_layouts() error returns) and reboot the node. Until then, mounts without the DAX window are not exposed, so inventory virtiofs mount options before deciding the window is urgent. The kernel commits are the only fix reference in this record.

References

Related entries

• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel FUSE: io_uring queues published without release ordering can be read half-initializedCVE-2026-80858 · Linux kernel FUSE (io_uring queue publication ordering)Unscored
• Linux kernel FUSE: missing read barrier in the io-uring readiness check can reintroduce a lock-order deadlockCVE-2026-80859 · Linux kernel FUSE (fuse-over-io-uring readiness check in fuse_block_alloc)Unscored
• Linux kernel FUSE: race between request interrupt and resend leaves a request queued on the interrupt listCVE-2026-80860 · Linux kernel FUSE (interrupt vs. resend request handling)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored