The Linux kernel function fuse_do_setattr mistakenly retains a filemap_invalidate_lock when a writeback flush fails during a setuid file truncate. This leaked lock causes subsequent file operations to block on a stale read–write semaphore, making the filesystem unresponsive and leading to a denial of service. The flaw is a kernel resource synchronization bug that can be triggered when an administrator or compromised application performs truncate calls on DAX‑backed setuid files.

All Linux kernel releases that incorporate the FUSE driver are affected, including both standard and enterprise distributions. The vulnerability exists in any kernel that has not yet applied the commit that adds an unlock label to release the lock on error paths. The kernel package is available for all mainstream Linux vendors.

The flaw is local and requires the ability to perform a truncate operation on a setuid file via FUSE. Because the kernel leaks a lock, an attacker with such access can cause a denial of service that impacts all operations on that file, potentially cascading to system‑wide stalls. The CVE does not have an EPSS score or KEV listing, but the severity of the impact and the patch nature suggest a high risk for affected systems. The attack vector is likely local, but in environments where elevated privileges are widely available (e.g., setuid binaries or services running as privileged users), the threat of a DoS expands considerably.