{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90096 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90096 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90096 and fix it if it is affected.\n\nWhat it is: CVE-2026-90096 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90096 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90096/ (Markdown: https://insights.sbomify.com/CVE-2026-90096/index.md)","id":"CVE-2026-90096","markdown":"https://insights.sbomify.com/CVE-2026-90096/index.md","name":"CVE-2026-90096","record":{"aliases":["GHSA-279q-p928-6329","UBUNTU-CVE-2026-90096"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A race condition in the Linux kernel FUSE module allows local attackers to read stale data from file tails during concurrent direct and buffered writes.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: invalidate the correct range after O_APPEND direct write\n\nfuse_direct_write_iter() captures pos before generic_write_checks(),\nwhich moves ki_pos to EOF for O_APPEND writes:\n\n  fuse_direct_write_iter()\n  {\n      pos = iocb-\u003eki_pos;           /* 0 (user-supplied)       */\n      generic_write_checks();       /* ki_pos -\u003e EOF           */\n      fuse_direct_io();             /* writes at EOF, correct  */\n      invalidate(pos, pos + res);   /* [0, res) -- wrong       */\n  }\n\nThe post-write invalidation targets a stale range instead of the\nactual written range at EOF.\n\nThis can cause data inconsistency when the file size is not\npage-aligned.  The tail page straddling EOF has a valid portion\nbefore EOF that concurrent readers can fault back in during the\nDIO write window:\n\n  Tail page (file size X not page-aligned):\n\n    page_start         X (EOF)   page_end\n    |--- valid data ----|-- stale --|\n\n  CPU0 (O_APPEND DIO writer)    CPU1 (buffered reader)\n  --------------------------    ----------------------\n  invalidate [X, X+len)\n    tail page evicted\n  FUSE_WRITE in flight ...\n                                read [page_start, X)\n                                  tail page re-faulted\n                                  [X, page_end) = stale\n  FUSE_WRITE completes\n  i_size = X + len\n  invalidate [0, len)  \u003c- WRONG\n    tail page still cached\n                                read [X, X+len)\n                                  hits stale tail page\n                                  returns old data\n\nFix by reading pos back from iocb-\u003eki_pos after generic_write_checks(),\nas generic_file_direct_write() does.\n\nAlso fix a typo in the comment (\"may have\" -\u003e \"may have competed\").","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"fuse: invalidate the correct range after O_APPEND direct write","id":"CVE-2026-90096","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition","id":"CVE-2026-90097"},"packages":[],"prev":{"headline":"fuse: Fix the condition to enable over-io-uring","id":"CVE-2026-90095"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel FUSE module allows local attackers to read stale data from file tails during concurrent direct and buffered writes.","url":"https://insights.sbomify.com/CVE-2026-90096/"}