Executive brief
The Linux kernel's FUSE (Filesystem in Userspace) module contains a resource leak when opening a file with truncation and Direct Access (DAX) enabled. If a signal interrupts the file open operation at the wrong moment, an internal lock (invalidate_lock) is not properly released, causing subsequent file operations like truncate or page faults to hang indefinitely, resulting in system responsiveness degradation.
Technical details
This is a resource leak vulnerability in the fuse_open() function within the Linux kernel FUSE filesystem module. The fuse_open() function acquires filemap_invalidate_lock() when performing a DAX truncate operation but fails to release it when fuse_dax_break_layouts() returns -ERESTARTSYS (a signal interrupt). The vulnerable code path shows: when O_TRUNC is used on a DAX file, the lock is acquired but an early goto out_inode_unlock label skips the unlock path, leaking the rwsem. Specifically, fuse_dax_break_layouts() can be interrupted by a signal while waiting for busy DAX pages to drain (TASK_INTERRUPTIBLE state). The fix moves filemap_invalidate_unlock() below the error handling label to ensure all code paths release the lock. The vulnerability affects Linux kernel v6.0 and later, and is fixed via upstream commit a927f1867e61b78f39f9da0bbba3c98c2ca151fe.
Affected products
- Linux Linux kernel 6.0 and later
Timeline
- 2026-09-04: disclosed: CVE-2026-80855 published on NVD
- 2026-09-02: patched: Fix committed to Linux kernel stable tree by Greg Kroah-Hartman