CVE-2026-80856

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on setattr writeback failure

fusedosetattr() takes filemapinvalidatelock() for a DAX truncate (faultblocked = true) and releases it at the out:/error: labels. But when a writeback flush is also needed, a writeinode_now() failure returns directly and leaks the lock, so any later fault or truncate on the file stalls on the stale rwsem.

For example, truncate(2) on a setuid file reaches fusedosetattr() with both ATTRSIZE and ATTRMODE set:

truncate(2) └─ dotruncate() ├─ dentryneedsremoveprivs() # SISUID └─ notifychange() # KILLSUID -> ATTRMODE └─ fusesetattr() # no killpriv: │ # iavalid |= ATTRMODE └─ fusedosetattr() ├─ filemapinvalidatelock() # ISDAX && istruncate └─ writeinodenow() # iswb && ATTR_MODE └─ if (err) # e.g. daemon -> -EIO return err # <- lock leaked

Fix this by adding an unlock label that releases the lock before returning the error, and use it for the fusedaxbreak_layouts() failure path as well.