Executive brief
The Linux kernel's FUSE (Filesystem in Userspace) implementation contains a lock management bug in file attribute setting operations. When certain error conditions occur during file metadata changes (particularly truncation on setuid files), a synchronization lock is not properly released, causing subsequent file operations to stall indefinitely. This can result in frozen or unresponsive file access for applications.
Technical details
The vulnerability is a lock leak in the fuse_do_setattr() function in fs/fuse/dir.c. The function acquires a filemap_invalidate_lock() for DAX truncate operations but fails to release it when write_inode_now() or fuse_dax_break_layouts() return errors, instead returning directly without unlocking. The bug occurs when both ATTR_SIZE and ATTR_MODE are set (e.g., during truncate on a setuid file) and a writeback operation fails with an error like -EIO. Subsequent truncate or fault operations on the affected file stall on the unreleased rwsem. The fix adds an "unlock" label that ensures filemap_invalidate_unlock() is called before returning errors in all code paths. This is a local denial-of-service condition affecting systems using FUSE filesystems, particularly virtiofs on v5.10+.
Affected products
- Linux Linux kernel 5.10 and later
Timeline
- 2026-09-04: disclosed: Published as CVE-2026-80856
- 2026-09-02: patched: Fix committed by Greg Kroah-Hartman