{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fuse: fix invalidate lock leak on setattr writeback failure  fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate (fault_blocked = true) and releases it at the out:/error: labels.  But when a writeback flush is also needed, a write_inode_now() failure returns directly and leaks the lock, so any later fault or truncate on the file stalls on the stale rwsem.  For example, truncate(2) on a setuid file reaches fuse_do_setattr() with both ATTR_SIZE and ATTR_MODE set:    truncate(2)   └─ do_truncate()      ├─ dentry_needs_remove_privs()         # S_ISUID      └─ notify_change()                     # KILL_SUID -\u003e ATTR_MODE         └─ fuse_setattr()                   # no killpriv:            │                                #   ia_valid |= ATTR_MODE            └─ fuse_do_setattr()               ├─ filemap_invalidate_lock()  # IS_DAX \u0026\u0026 is_truncate               └─ write_inode_now()          # is_wb \u0026\u0026 ATTR_MODE                  └─ if (err)                # e.g. daemon -\u003e -EIO                     return err              # \u003c- lock leaked  Fix this by adding an unlock label that releases the lock before returning the error, and use it for the fuse_dax_break_layouts() failure path as well.",
  "id": "DEBIAN-CVE-2026-80856",
  "modified": "2026-09-14T16:47:46.912340254Z",
  "published": "2026-09-04T16:18:14.660Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80856"
    }
  ],
  "upstream": [
    "CVE-2026-80856"
  ]
}