CVE-2026-80856 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse: fix invalidate lock leak on setattr writeback failure
fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate (fault_blocked = true) and releases it at the out:/error: labels. But when a writeback flush is also needed, a write_inode_now() failure returns directly and leaks the lock, so any later fault or truncate on the file stalls on the stale rwsem.
For example, truncate(2) on a setuid file reaches fuse_do_setattr() with both ATTR_SIZE and ATTR_MODE set:
truncate(2) └─ do_truncate() ├─ dentry_needs_remove_privs() # S_ISUID └─ notify_change() # KILL_SUID -> ATTR_MODE └─ fuse_setattr() # no killpriv: │ # ia_valid |= ATTR_MODE └─ fuse_do_setattr() ├─ filemap_invalidate_lock() # IS_DAX && is_truncate └─ write_inode_now() # is_wb && ATTR_MODE └─ if (err) # e.g. daemon -> -EIO return err # <- lock leaked
Fix this by adding an unlock label that releases the lock before returning the error, and use it for the fuse_dax_break_layouts() failure path as well.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel's FUSE (Filesystem in Userspace) subsystem contains a critical resource management flaw within its attribute setting logic, specifically affecting Direct Access or DAX files where writeback operations are required during metadata changes. This vulnerability manifests when the fuse_do_setattr function is invoked to modify file attributes such as size and mode simultaneously, which commonly occurs during privileged operations like truncating setuid binaries. The core technical issue stems from an improper handling of the filemap_invalidate_lock semaphore in error paths where asynchronous writeback fails. Under normal operation for DAX files undergoing a truncate with associated attribute changes, the kernel acquires this read-write semaphore to ensure exclusive access while invalidating page cache mappings and performing layout breaks. However, if the subsequent call to write_inode_now encounters an error condition, such as an input/output failure from the FUSE daemon, the function returns immediately without releasing the acquired lock.
This oversight results in a persistent leak of the filemap_invalidate_lock, leaving it held by a thread that has already exited its critical section logic. The operational impact is severe because any subsequent operation on the same file that requires this semaphore will block indefinitely waiting for release. This includes standard file faults and truncate operations performed by other processes or system calls. Consequently, this leads to a denial of service scenario where legitimate I/O requests stall, potentially causing application hangs or system-wide instability depending on which files are affected. The vulnerability is particularly insidious because it requires specific conditions involving DAX support, setuid bits, and writeback failures to trigger the lock leak, making it difficult to reproduce in standard environments but highly disruptive when triggered.
From a classification perspective, this issue aligns with CWE-404, which describes improper release of a resource or ownership thereof, specifically focusing on failure to unlock mutexes or semaphores after acquisition. In terms of attack vectors and defensive mapping, the ATT&CK framework categorizes such behavior under T1562.001, Impair Defenses: Disable or Modify Tools, as it effectively disables file system operations for affected files by causing resource contention that halts progress. The root cause lies in a structural deficiency within the error handling path of fuse_do_setattr, where early returns bypass standard cleanup routines designed to maintain synchronization primitives integrity.
To mitigate this vulnerability and restore proper kernel stability, developers have implemented a fix that introduces dedicated unlock labels for all exit paths involving lock acquisition. By ensuring that filemap_invalidate_lock is explicitly released before returning error codes from write_inode_now failures or fuse_dax_break_layouts failures, the race condition leading to deadlock is eliminated. System administrators should apply the latest kernel updates containing this patch immediately to prevent potential service disruptions in environments relying on FUSE with DAX capabilities and setuid file modifications. Regular auditing of lock acquisition patterns in filesystem drivers remains essential to identify similar resource management flaws before they impact production systems.