CVE-2026-80855
kernel: fuse: fix invalidate lock leak on open O_TRUNC DAX failure
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 4, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's Filesystem in Userspace (FUSE) component. A local user could exploit this by opening a file with the O_TRUNC flag, which attempts to truncate the file. If a signal interrupts the Direct Access (DAX) page invalidation process during this operation, a lock can be leaked. This leaked lock can cause subsequent file operations, such as further truncates or faults, to stall indefinitely, leading to a denial of service.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime