CVE-2026-80856

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix invalidate lock leak on setattr writeback failure

fuse do setattr() takes filemap invalidate lock() for a DAX truncate (fault blocked = true) and releases it at the out:/error: labels. But when a writeback flush is also needed, a write inode now() failure returns directly and leaks the lock, so any later fault or truncate on the file stalls on the stale rwsem.

For example, truncate(2) on a setuid file reaches fuse do setattr() with both ATTR SIZE and ATTR MODE set:

truncate(2) └─ do truncate() ├─ dentry needs remove privs() # S ISUID └─ notify change() # KILL SUID -> ATTR MODE └─ fuse setattr() # no killpriv: │ # ia valid |= ATTR MODE └─ fuse do setattr() ├─ filemap invalidate lock() # IS DAX && is truncate └─ write inode now() # is wb && ATTR MODE └─ if (err) # e.g. daemon -> -EIO return err # <- lock leaked

Fix this by adding an unlock label that releases the lock before returning the error, and use it for the fuse dax break layouts() failure path as well.