CVE-2026-80855
Description
In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open O_TRUNC DAX failure fuse_open() takes filemap_invalidate_lock() for a DAX truncate (dax_truncate = true) and releases it before the out_inode_unlock label. But when fuse_dax_break_layouts() fails, the goto out_inode_unlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock. fuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain: open("file", O_RDWR | O_TRUNC) └─ fuse_open() ├─ filemap_invalidate_lock() # dax_truncate └─ fuse_dax_break_layouts() └─ dax_break_layout() └─ wait_page_idle() # TASK_INTERRUPTIBLE └─ fuse_wait_dax_page() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto out_inode_unlock # <- lock leaked Fix this by moving filemap_invalidate_unlock() below the label so that all error paths release the lock, and rename the label to out_unlock as it now covers more than just the inode lock.
How to fix
- Linux Linux69a294e561c10909688bcb25456535dcd1818e1a, 1b04d80a27d317064cce2307472f5bef9975bc50, a61524da59a2f5ac9c8de23ff98b30da769ab144, dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010, 7288c279ddbd654a06c82118c1a3f5570c1807f0, 776e85fda752f9a15e0f82dec42ecacd12a9bd94, 1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da, e981474d7bf1457da12404e169ea147d2c8ecea7, a927f1867e61b78f39f9da0bbba3c98c2ca151fe, 5.10.273, 5.15.220, 5.19, 5.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 81775ab858b4236c52c5da7e25cec6e49dd91b46 ≤ v < 69a294e561c10909688bcb25456535dcd1818e1a, d58366aab86854217b81679d1a9dcd54a2edfc2a ≤ v < 1b04d80a27d317064cce2307472f5bef9975bc50, 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b ≤ v < a61524da59a2f5ac9c8de23ff98b30da769ab144, 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b ≤ v < dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010, 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b ≤ v < 7288c279ddbd654a06c82118c1a3f5570c1807f0, 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b ≤ v < 776e85fda752f9a15e0f82dec42ecacd12a9bd94, 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b ≤ v < 1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da, 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b ≤ v < e981474d7bf1457da12404e169ea147d2c8ecea7, 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b ≤ v < a927f1867e61b78f39f9da0bbba3c98c2ca151fe, b57e150ac2eac791d5d187923b73dc2dafaf67fa, 1fdbbe246daf348adaa0739463384b16ceba1fc0, 5.10.179 ≤ v < 5.10.273, 5.15.109 ≤ v < 5.15.220, 5.18.18 ≤ v < 5.19, 5.19.2 ≤ v < 5.20, 6.0 | 69a294e561c10909688bcb25456535dcd1818e1a, 1b04d80a27d317064cce2307472f5bef9975bc50, a61524da59a2f5ac9c8de23ff98b30da769ab144, dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010, 7288c279ddbd654a06c82118c1a3f5570c1807f0, 776e85fda752f9a15e0f82dec42ecacd12a9bd94, 1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da, e981474d7bf1457da12404e169ea147d2c8ecea7, a927f1867e61b78f39f9da0bbba3c98c2ca151fe, 5.10.273, 5.15.220, 5.19, 5.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.