In the Linux kernel, the following vulnerability has been resolved:
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
fuseopen() takes filemapinvalidatelock() for a DAX truncate (daxtruncate = true) and releases it before the outinodeunlock label. But when fusedaxbreaklayouts() fails, the goto outinode_unlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock.
fusedaxbreak_layouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain:
open("file", ORDWR | OTRUNC) └─ fuseopen() ├─ filemapinvalidatelock() # daxtruncate └─ fusedaxbreaklayouts() └─ daxbreaklayout() └─ waitpageidle() # TASKINTERRUPTIBLE └─ fusewaitdaxpage() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto outinode_unlock # <- lock leaked
Fix this by moving filemapinvalidateunlock() below the label so that all error paths release the lock, and rename the label to out_unlock as it now covers more than just the inode lock.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80855.json"
}