CVE-2026-68149 (GCVE-0-2026-68149)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-08-17 04:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
The ACL_DONT_CACHE state is meant to be a constant state for the inode
for filesystems that want to opt out of posix acl caching.
Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api")
used this facility to opt out of posix acl caching for fuse inodes with
fuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl).
The commit also takes care to gate the forget_all_cached_acls() call in
fuse_set_acl() on fc->posix_acl because there is no need for it, but
there are other placed in fuse code which call forget_all_cached_acls()
unconditional to fc->posix_acl and those cause the loss of the
ACL_DONT_CACHE state.
This is not only a functional bug. Properly timed, a get_acl() from this
fuse filesystem can return a stale cached value, as was observed in tests,
because set_acl() does not invalidate the unintentional acl cache.
We could fix this in fuse, but it actually makes no sense for the vfs
helper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so
let it not do that to fix fuse and future users of ACL_DONT_CACHE.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/posix_acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "834ddf899484a2f23129080e8773bc04f4691d07",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "a019b074903b3ad0a9726087efd0e8291452023b",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "ca03a7984a34f48085fd013e0d2cf4e6420b4acf",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "4b9a5458d02e214ef2b384124ca626e3e381d778",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/posix_acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: preserve ACL_DONT_CACHE state in forget_cached_acl()\n\nThe ACL_DONT_CACHE state is meant to be a constant state for the inode\nfor filesystems that want to opt out of posix acl caching.\n\nCommit facd61053cff1 (\"fuse: fixes after adapting to new posix acl api\")\nused this facility to opt out of posix acl caching for fuse inodes with\nfuse server that does not negotiate FUSE_POSIX_ACL (fc-\u003eposix_acl).\n\nThe commit also takes care to gate the forget_all_cached_acls() call in\nfuse_set_acl() on fc-\u003eposix_acl because there is no need for it, but\nthere are other placed in fuse code which call forget_all_cached_acls()\nunconditional to fc-\u003eposix_acl and those cause the loss of the\nACL_DONT_CACHE state.\n\nThis is not only a functional bug. Properly timed, a get_acl() from this\nfuse filesystem can return a stale cached value, as was observed in tests,\nbecause set_acl() does not invalidate the unintentional acl cache.\n\nWe could fix this in fuse, but it actually makes no sense for the vfs\nhelper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so\nlet it not do that to fix fuse and future users of ACL_DONT_CACHE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local VFS syscalls (getxattr, statx, open, read, write) on a FUSE-backed mount; the bug is in kernel ACL caching, not in a network protocol handler.\nAC:L - The attacker controls the full trigger sequence (stat/getattr to clear ACL_DONT_CACHE, getxattr to populate cache, ACL change, then access) and can drive timing with concurrent threads without depending on uncontrollable system state.\nPR:L - Any unprivileged local user who can mount or access a FUSE filesystem (fusermount, user namespaces, virtio-fs/SSHFS mounts with allow_other) can reach the vulnerable code paths on files within that mount.\nUI:N - Exploitation is fully attacker-driven through syscall sequences on the FUSE mount; no victim click, mount action, or other interactive cooperation is required beyond routine filesystem use.\nS:C - On virtio-fs/Kata/Firecracker shared host directories, stale kernel ACL enforcement can let a guest/container process access host-exported files beyond the permissions the host administrator intended, crossing that isolation boundary.\nC:H - Stale permissive cached ACLs cause check_acl()/posix_acl_permission() to authorize reads of files that should be denied after ACL tightening, enabling unauthorized disclosure of protected file contents on default_permissions mounts.\nI:H - The same stale ACL bypass lets an attacker obtain write permission enforced by the kernel VFS on files whose ACLs were subsequently restricted, enabling unauthorized modification of protected data.\nA:N - This is a stale-cache logic bug with no memory corruption, kernel crash, panic, or hang; observed impact is incorrect ACL enforcement and authorization bypass, not availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:59:43.618Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf"
},
{
"url": "https://git.kernel.org/stable/c/834ddf899484a2f23129080e8773bc04f4691d07"
},
{
"url": "https://git.kernel.org/stable/c/a019b074903b3ad0a9726087efd0e8291452023b"
},
{
"url": "https://git.kernel.org/stable/c/ca03a7984a34f48085fd013e0d2cf4e6420b4acf"
},
{
"url": "https://git.kernel.org/stable/c/4b9a5458d02e214ef2b384124ca626e3e381d778"
}
],
"title": "fs: preserve ACL_DONT_CACHE state in forget_cached_acl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68149",
"datePublished": "2026-08-10T11:59:14.645Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-08-17T04:59:43.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…