FKIE_CVE-2026-90096

Vulnerability from fkie_nvd - Published: 2026-09-17 17:17 - Updated: 2026-09-17 17:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: fuse: invalidate the correct range after O_APPEND direct write fuse_direct_write_iter() captures pos before generic_write_checks(), which moves ki_pos to EOF for O_APPEND writes: fuse_direct_write_iter() { pos = iocb->ki_pos; /* 0 (user-supplied) */ generic_write_checks(); /* ki_pos -> EOF */ fuse_direct_io(); /* writes at EOF, correct */ invalidate(pos, pos + res); /* [0, res) -- wrong */ } The post-write invalidation targets a stale range instead of the actual written range at EOF. This can cause data inconsistency when the file size is not page-aligned. The tail page straddling EOF has a valid portion before EOF that concurrent readers can fault back in during the DIO write window: Tail page (file size X not page-aligned): page_start X (EOF) page_end |--- valid data ----|-- stale --| CPU0 (O_APPEND DIO writer) CPU1 (buffered reader) -------------------------- ---------------------- invalidate [X, X+len) tail page evicted FUSE_WRITE in flight ... read [page_start, X) tail page re-faulted [X, page_end) = stale FUSE_WRITE completes i_size = X + len invalidate [0, len) <- WRONG tail page still cached read [X, X+len) hits stale tail page returns old data Fix by reading pos back from iocb->ki_pos after generic_write_checks(), as generic_file_direct_write() does. Also fix a typo in the comment ("may have" -> "may have competed").
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/26d7e1f5c407b5859122b5cd47d7ebbf4b4c1cd2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/833963069adf86dcbdffd4e7d7b3171f95070b77
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "833963069adf86dcbdffd4e7d7b3171f95070b77",
              "status": "affected",
              "version": "2b0408d0284f4ff376cf5610fa8c9905e93c2541",
              "versionType": "git"
            },
            {
              "lessThan": "26d7e1f5c407b5859122b5cd47d7ebbf4b4c1cd2",
              "status": "affected",
              "version": "2b0408d0284f4ff376cf5610fa8c9905e93c2541",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: invalidate the correct range after O_APPEND direct write\n\nfuse_direct_write_iter() captures pos before generic_write_checks(),\nwhich moves ki_pos to EOF for O_APPEND writes:\n\n  fuse_direct_write_iter()\n  {\n      pos = iocb-\u003eki_pos;           /* 0 (user-supplied)       */\n      generic_write_checks();       /* ki_pos -\u003e EOF           */\n      fuse_direct_io();             /* writes at EOF, correct  */\n      invalidate(pos, pos + res);   /* [0, res) -- wrong       */\n  }\n\nThe post-write invalidation targets a stale range instead of the\nactual written range at EOF.\n\nThis can cause data inconsistency when the file size is not\npage-aligned.  The tail page straddling EOF has a valid portion\nbefore EOF that concurrent readers can fault back in during the\nDIO write window:\n\n  Tail page (file size X not page-aligned):\n\n    page_start         X (EOF)   page_end\n    |--- valid data ----|-- stale --|\n\n  CPU0 (O_APPEND DIO writer)    CPU1 (buffered reader)\n  --------------------------    ----------------------\n  invalidate [X, X+len)\n    tail page evicted\n  FUSE_WRITE in flight ...\n                                read [page_start, X)\n                                  tail page re-faulted\n                                  [X, page_end) = stale\n  FUSE_WRITE completes\n  i_size = X + len\n  invalidate [0, len)  \u003c- WRONG\n    tail page still cached\n                                read [X, X+len)\n                                  hits stale tail page\n                                  returns old data\n\nFix by reading pos back from iocb-\u003eki_pos after generic_write_checks(),\nas generic_file_direct_write() does.\n\nAlso fix a typo in the comment (\"may have\" -\u003e \"may have competed\")."
    }
  ],
  "id": "CVE-2026-90096",
  "lastModified": "2026-09-17T17:17:01.233",
  "metrics": {},
  "published": "2026-09-17T17:17:01.233",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/26d7e1f5c407b5859122b5cd47d7ebbf4b4c1cd2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/833963069adf86dcbdffd4e7d7b3171f95070b77"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.