CVE-2026-90096 fuse: invalidate the correct range after O_APPEND direct write
A race condition in the Linux kernel FUSE module allows local attackers to read stale data from file tails during concurrent direct and buffered writes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90096?
CVE-2026-90096 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fuse: invalidate the correct range after O_APPEND direct write
fuse_direct_write_iter() captures pos before generic_write_checks(), which moves ki_pos to EOF for O_APPEND writes:
fuse_direct_write_iter() { pos = iocb->ki_pos; /* 0 (user-supplied) */ generic_write_checks(); /* ki_pos -> EOF */ fuse_direct_io(); /* writes at EOF, correct */ invalidate(pos, pos + res); /* [0, res) -- wrong */ }
The post-write invalidation targets a stale range instead of the actual written range at EOF.
This can cause data inconsistency when the file size is not page-aligned. The tail page straddling EOF has a valid portion before EOF that concurrent readers can fault back in during the DIO write window:
Tail page (file size X not page-aligned):
page_start X (EOF) page_end |--- valid data ----|-- stale --|
CPU0 (O_APPEND DIO writer) CPU1 (buffered reader) -------------------------- ---------------------- invalidate [X, X+len) tail page evicted FUSE_WRITE in flight ... read [page_start, X) tail page re-faulted [X, page_end) = stale FUSE_WRITE completes i_size = X + len invalidate [0, len) <- WRONG tail page still cached read [X, X+len) hits stale tail page returns old data
Fix by reading pos back from iocb->ki_pos after generic_write_checks(), as generic_file_direct_write() does.
Also fix a typo in the comment ("may have" -> "may have competed").
Which versions are affected by CVE-2026-90096?
How do I fix CVE-2026-90096?
Apply the vendor's patch.
Is CVE-2026-90096 being exploited?
There is no known exploitation of CVE-2026-90096 in the wild and no public exploit code.
Sources
Also known as GHSA-279q-p928-6329, UBUNTU-CVE-2026-90096.