CVE-2026-90096

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fuse: invalidate the correct range after O_APPEND direct write

fuse_direct_write_iter() captures pos before generic_write_checks(),

which moves ki_pos to EOF for O_APPEND writes:

fuse_direct_write_iter()

{

pos = iocb->ki_pos; /* 0 (user-supplied) */

generic_write_checks(); /* ki_pos -> EOF */

fuse_direct_io(); /* writes at EOF, correct */

invalidate(pos, pos + res); /* [0, res) -- wrong */

}

The post-write invalidation targets a stale range instead of the

actual written range at EOF.

This can cause data inconsistency when the file size is not

page-aligned. The tail page straddling EOF has a valid portion

before EOF that concurrent readers can fault back in during the

DIO write window:

Tail page (file size X not page-aligned):

page_start X (EOF) page_end

|--- valid data ----|-- stale --|

CPU0 (O_APPEND DIO w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References