GHSA-VQPH-P58C-7G7W
Vulnerability from github – Published: 2026-09-04 18:31 – Updated: 2026-09-04 18:31In the Linux kernel, the following vulnerability has been resolved:
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
fuse_open() takes filemap_invalidate_lock() for a DAX truncate (dax_truncate = true) and releases it before the out_inode_unlock label. But when fuse_dax_break_layouts() fails, the goto out_inode_unlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock.
fuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain:
open("file", O_RDWR | O_TRUNC) └─ fuse_open() ├─ filemap_invalidate_lock() # dax_truncate └─ fuse_dax_break_layouts() └─ dax_break_layout() └─ wait_page_idle() # TASK_INTERRUPTIBLE └─ fuse_wait_dax_page() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto out_inode_unlock # <- lock leaked
Fix this by moving filemap_invalidate_unlock() below the label so that all error paths release the lock, and rename the label to out_unlock as it now covers more than just the inode lock.
{
"affected": [],
"aliases": [
"CVE-2026-80855"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T16:18:14Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: fix invalidate lock leak on open O_TRUNC DAX failure\n\nfuse_open() takes filemap_invalidate_lock() for a DAX truncate\n(dax_truncate = true) and releases it before the out_inode_unlock\nlabel. But when fuse_dax_break_layouts() fails, the goto\nout_inode_unlock skips the unlock and leaks the rwsem, so any later\nfault or truncate on the file stalls on the stale lock.\n\nfuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal\ninterrupts the wait for busy DAX pages to drain:\n\n open(\"file\", O_RDWR | O_TRUNC)\n \u2514\u2500 fuse_open()\n \u251c\u2500 filemap_invalidate_lock() # dax_truncate\n \u2514\u2500 fuse_dax_break_layouts()\n \u2514\u2500 dax_break_layout()\n \u2514\u2500 wait_page_idle() # TASK_INTERRUPTIBLE\n \u2514\u2500 fuse_wait_dax_page() # unlock, schedule, re-lock\n \u2514\u2500 signal \u2192 -ERESTARTSYS\n goto out_inode_unlock # \u003c- lock leaked\n\nFix this by moving filemap_invalidate_unlock() below the label so\nthat all error paths release the lock, and rename the label to\nout_unlock as it now covers more than just the inode lock.",
"id": "GHSA-vqph-p58c-7g7w",
"modified": "2026-09-04T18:31:29Z",
"published": "2026-09-04T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80855"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1b04d80a27d317064cce2307472f5bef9975bc50"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1d3e701cda2f41d48aa721b3ebefbe0fbf8d74da"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7288c279ddbd654a06c82118c1a3f5570c1807f0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/776e85fda752f9a15e0f82dec42ecacd12a9bd94"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a61524da59a2f5ac9c8de23ff98b30da769ab144"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a927f1867e61b78f39f9da0bbba3c98c2ca151fe"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dcf30a56624c2a0cfab1bada5b1ca8cc0c02f010"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e981474d7bf1457da12404e169ea147d2c8ecea7"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.