Cloudanix VulnDB

CVE-2026-68149

High · 8.4

CVSS

8.4

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Linux kernel bug in certain virtual filesystems can let local users access or change files using old permission settings instead of the current ones.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes forget_cached_acl() to clear the ACL_DONT_CACHE flag on inodes, allowing subsequent forget_all_cached_acls() calls in FUSE to drop the opt-out state and return stale cached ACLs instead of querying the server.

Why it matters to the business

Local users on systems using FUSE filesystems without POSIX ACL negotiation can obtain or modify data using incorrect cached permissions, increasing risk of unauthorized access or data tampering on affected Linux deployments.

How an attack unfolds

An attacker with local access mounts or interacts with a FUSE filesystem lacking FUSE_POSIX_ACL support, triggers set_acl followed by get_acl at the right timing to hit the stale cache, and bypasses intended ACL enforcement.

How to fix it

Update the Linux kernel to a version containing the fix that preserves ACL_DONT_CACHE in forget_cached_acl(); rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm the kernel source contains the updated forget_cached_acl() logic that skips clearing ACL_DONT_CACHE, or verify the running kernel version is newer than the vulnerable commit range via uname and kernel changelog.

Typical attack path

  1. Obtain local user access on Linux host using vulnerable kernel
  2. Interact with FUSE mount that does not negotiate POSIX ACL support
  3. Perform operations that invoke set_acl then get_acl in sequence
  4. Read or write files using permissions from the stale cached ACL

How to detect it

Review kernel audit logs and FUSE-related syscalls for repeated set_acl/get_acl sequences on inodes that should have ACL_DONT_CACHE; correlate with unexpected file access succeeding where current ACLs would deny it.

What your security team should do

  • Prioritize kernel updates on all systems using FUSE mounts
  • Audit FUSE-based filesystems for ACL usage and enforce server-side controls where possible
  • Monitor for local privilege-escalation attempts targeting ACL caches

The record

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() The ACL_DONT_CACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api") used this facility to opt out of posix acl caching for fuse inodes with fuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl). The commit also takes care to gate the forget_all_cached_acls() call in fuse_set_acl() on fc->posix_acl because there is no need for it, but there are other placed in fuse code which call forget_all_cached_acls() unconditional to fc->posix_acl and those cause the loss of the ACL_DONT_CACHE state. This is not only a functional bug. Properly timed, a get_acl() from this fuse filesystem can return a stale cached value, as was observed in tests, because set_acl() does not invalidate the unintentional acl cache. We could fix this in fuse, but it actually makes no sense for the vfs helper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so let it not do that to fix fuse and future users of ACL_DONT_CACHE.

Affected packages

Ecosystem Package Introduced Fixed