CVE-2026-80856 Overview
CVE-2026-80856 is a Linux kernel vulnerability in the Filesystem in Userspace (FUSE) subsystem. The flaw exists in fuse_do_setattr(), which fails to release filemap_invalidate_lock() when write_inode_now() returns an error during a Direct Access (DAX) truncate operation. The leaked reader-writer semaphore causes subsequent page faults and truncate operations on the affected file to stall indefinitely. The issue is triggered on paths where both ATTR_SIZE and ATTR_MODE are set, such as truncate(2) on a setuid file backed by a FUSE DAX mount.
Critical Impact
A userspace FUSE daemon returning an I/O error during writeback can permanently stall all future fault or truncate operations on the file, producing a per-file denial of service.
Affected Products
- Linux kernel builds with FUSE and DAX support enabled
- Distributions shipping affected upstream kernel versions prior to the referenced stable commits
- Virtualization and container hosts using FUSE-backed DAX filesystems (for example, virtiofs)
Discovery Timeline
- 2026-09-04 - CVE-2026-80856 published to the National Vulnerability Database
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80856
Vulnerability Analysis
The vulnerability is a lock leak in the FUSE setattr code path that leads to a denial of service on the affected inode. fuse_do_setattr() acquires filemap_invalidate_lock() when a DAX truncate is in progress and normally releases the lock at the out: and error: labels. When a writeback flush is also required, the function calls write_inode_now() and returns its error code directly, bypassing the unlock paths. The result is a stale write-held rwsem on the inode's i_mapping->invalidate_lock.
Any thread that later attempts a page fault, truncate, or other operation requiring the invalidate lock blocks indefinitely on the leaked semaphore. This produces a per-file hang that persists until the inode is evicted, effectively denying further I/O to the file.
Root Cause
The root cause is a missing unlock on an error return path in fuse_do_setattr(). The function structures cleanup around goto labels, but the write_inode_now() failure branch returns directly with return err instead of jumping to a label that releases filemap_invalidate_lock(). The fuse_dax_break_layouts() failure path shares the same defect. This is a resource management error in error handling, related to [CWE-667] Improper Locking.
Attack Vector
Triggering the bug requires an operation that sets both ATTR_SIZE and ATTR_MODE on a DAX-backed FUSE inode combined with a writeback failure. A concrete path is truncate(2) on a setuid file: do_truncate() invokes dentry_needs_remove_privs() and notify_change() with KILL_SUID, adding ATTR_MODE alongside ATTR_SIZE. If the userspace FUSE daemon returns an error such as -EIO during the ensuing write_inode_now(), the lock leaks.
A malicious or malfunctioning FUSE daemon can deterministically produce the writeback failure and induce the hang. Exploitation requires local access and the ability to interact with a FUSE DAX filesystem. The fix adds an unlock label and routes both the writeback and fuse_dax_break_layouts() failure paths through it. See the upstream fix commits on kernel.org for the corrected control flow.
Detection Methods for CVE-2026-80856
Indicators of Compromise
- Processes in uninterruptible sleep (D state) blocked on filemap_invalidate_lock or down_write against a FUSE inode
- Repeated hung_task warnings in dmesg referencing FUSE inode operations, truncate, or page fault handlers
- FUSE daemon logs showing writeback or write_inode errors immediately preceding stalls on the affected mount
Detection Strategies
- Audit the running kernel version against the fixed stable commits listed on kernel.org and flag hosts that still run vulnerable builds
- Correlate FUSE daemon error events with subsequent long-lived D-state processes accessing the same mount point
- Monitor /proc/<pid>/stack on stuck processes for frames in fuse_do_setattr, filemap_fault, or fuse_dax_break_layouts
Monitoring Recommendations
- Enable CONFIG_DETECT_HUNG_TASK and forward khungtaskd warnings to a centralized log pipeline for alerting
- Track kernel taint state, uptime, and FUSE mount inventory across the fleet to identify unpatched systems running FUSE DAX workloads
- Alert on abnormal rates of EIO responses from userspace FUSE daemons, particularly virtiofsd instances serving guest workloads
How to Mitigate CVE-2026-80856
Immediate Actions Required
- Inventory all systems that mount FUSE filesystems with DAX enabled, including virtiofs deployments on hypervisors
- Apply distribution kernel updates that incorporate the upstream FUSE setattr unlock fix as soon as vendor packages are available
- Restrict which local users and containers can mount or interact with FUSE DAX filesystems until patched builds are deployed
Patch Information
The fix is available in multiple Linux stable branches. The relevant upstream commits are 03cfeeb135428, 1758730d9eaa3, 8f14906ce9103, 92588d187ba46, 9afeca0d569c, dd278d954c0e, e8457ebfd77a, and ea9fea370b8de. The corrected code adds an unlock label in fuse_do_setattr() that releases filemap_invalidate_lock() before returning on both the write_inode_now() and fuse_dax_break_layouts() failure paths. Consult your distribution's security tracker for the corresponding backported package version.
Workarounds
- Disable DAX on FUSE mounts where feasible, since the leak only triggers when the DAX truncate path acquires filemap_invalidate_lock()
- Harden FUSE daemons to avoid returning errors from writeback operations that coincide with mode-changing truncates, reducing the trigger surface
- Limit exposure of FUSE DAX mounts to trusted users and services to prevent local attackers from deliberately triggering the hang
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
