CVE-2026-90096

In the Linux kernel, the following vulnerability has been resolved:

fuse: invalidate the correct range after O_APPEND direct write

fuse_direct_write_iter() captures pos before generic_write_checks(),

which moves ki_pos to EOF for O_APPEND writes:

fuse_direct_write_iter()

{

pos = iocb->ki_pos; /* 0 (user-supplied) */

generic_write_checks(); /* ki_pos -> EOF */

fuse_direct_io(); /* writes at EOF, correct */

invalidate(pos, pos + res); /* [0, res) -- wrong */

}

The post-write invalidation targets a stale range instead of the

actual written range at EOF.

This can cause data inconsistency when the file size is not

page-aligned. The tail page straddling EOF has a valid portion

before EOF that concurrent readers can fault back in during the

DIO write window:

Tail page (file size X not page-aligned):

page_start X (EOF) page_end

|--- valid data ----|-- stale --|

CPU0 (O_APPEND DIO writer) CPU1 (buffered reader)

-------------------------- ----------------------

invalidate [X, X+len)

tail page evicted

FUSE_WRITE in flight ...

read [page_start, X)

tail page re-faulted

[X, page_end) = stale

FUSE_WRITE completes

i_size = X + len

invalidate [0, len) <- WRONG

tail page still cached

read [X, X+len)

hits stale tail page

returns old data

Fix by reading pos back from iocb->ki_pos after generic_write_checks(),

as generic_file_direct_write() does.

Also fix a typo in the comment ("may have" -> "may have competed").