CVE-2026-68149 (GCVE-0-2026-68149)
Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-17 04:59
VLAI
EPSS
VEX
Title
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
The ACL_DONT_CACHE state is meant to be a constant state for the inode
for filesystems that want to opt out of posix acl caching.
Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api")
used this facility to opt out of posix acl caching for fuse inodes with
fuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl).
The commit also takes care to gate the forget_all_cached_acls() call in
fuse_set_acl() on fc->posix_acl because there is no need for it, but
there are other placed in fuse code which call forget_all_cached_acls()
unconditional to fc->posix_acl and those cause the loss of the
ACL_DONT_CACHE state.
This is not only a functional bug. Properly timed, a get_acl() from this
fuse filesystem can return a stale cached value, as was observed in tests,
because set_acl() does not invalidate the unintentional acl cache.
We could fix this in fuse, but it actually makes no sense for the vfs
helper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so
let it not do that to fix fuse and future users of ACL_DONT_CACHE.
Severity
8.4 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
facd61053cff100973921d4d45d47cf53c747ec6 , < b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf
(git)
Affected: facd61053cff100973921d4d45d47cf53c747ec6 , < 834ddf899484a2f23129080e8773bc04f4691d07 (git) Affected: facd61053cff100973921d4d45d47cf53c747ec6 , < a019b074903b3ad0a9726087efd0e8291452023b (git) Affected: facd61053cff100973921d4d45d47cf53c747ec6 , < ca03a7984a34f48085fd013e0d2cf4e6420b4acf (git) Affected: facd61053cff100973921d4d45d47cf53c747ec6 , < 4b9a5458d02e214ef2b384124ca626e3e381d778 (git) |
|
| Linux | Linux |
Affected:
6.2
Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/posix_acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "834ddf899484a2f23129080e8773bc04f4691d07",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "a019b074903b3ad0a9726087efd0e8291452023b",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "ca03a7984a34f48085fd013e0d2cf4e6420b4acf",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "4b9a5458d02e214ef2b384124ca626e3e381d778",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/posix_acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: preserve ACL_DONT_CACHE state in forget_cached_acl()\n\nThe ACL_DONT_CACHE state is meant to be a constant state for the inode\nfor filesystems that want to opt out of posix acl caching.\n\nCommit facd61053cff1 (\"fuse: fixes after adapting to new posix acl api\")\nused this facility to opt out of posix acl caching for fuse inodes with\nfuse server that does not negotiate FUSE_POSIX_ACL (fc-\u003eposix_acl).\n\nThe commit also takes care to gate the forget_all_cached_acls() call in\nfuse_set_acl() on fc-\u003eposix_acl because there is no need for it, but\nthere are other placed in fuse code which call forget_all_cached_acls()\nunconditional to fc-\u003eposix_acl and those cause the loss of the\nACL_DONT_CACHE state.\n\nThis is not only a functional bug. Properly timed, a get_acl() from this\nfuse filesystem can return a stale cached value, as was observed in tests,\nbecause set_acl() does not invalidate the unintentional acl cache.\n\nWe could fix this in fuse, but it actually makes no sense for the vfs\nhelper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so\nlet it not do that to fix fuse and future users of ACL_DONT_CACHE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local VFS syscalls (getxattr, statx, open, read, write) on a FUSE-backed mount; the bug is in kernel ACL caching, not in a network protocol handler.\nAC:L - The attacker controls the full trigger sequence (stat/getattr to clear ACL_DONT_CACHE, getxattr to populate cache, ACL change, then access) and can drive timing with concurrent threads without depending on uncontrollable system state.\nPR:L - Any unprivileged local user who can mount or access a FUSE filesystem (fusermount, user namespaces, virtio-fs/SSHFS mounts with allow_other) can reach the vulnerable code paths on files within that mount.\nUI:N - Exploitation is fully attacker-driven through syscall sequences on the FUSE mount; no victim click, mount action, or other interactive cooperation is required beyond routine filesystem use.\nS:C - On virtio-fs/Kata/Firecracker shared host directories, stale kernel ACL enforcement can let a guest/container process access host-exported files beyond the permissions the host administrator intended, crossing that isolation boundary.\nC:H - Stale permissive cached ACLs cause check_acl()/posix_acl_permission() to authorize reads of files that should be denied after ACL tightening, enabling unauthorized disclosure of protected file contents on default_permissions mounts.\nI:H - The same stale ACL bypass lets an attacker obtain write permission enforced by the kernel VFS on files whose ACLs were subsequently restricted, enabling unauthorized modification of protected data.\nA:N - This is a stale-cache logic bug with no memory corruption, kernel crash, panic, or hang; observed impact is incorrect ACL enforcement and authorization bypass, not availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:59:43.618Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf"
},
{
"url": "https://git.kernel.org/stable/c/834ddf899484a2f23129080e8773bc04f4691d07"
},
{
"url": "https://git.kernel.org/stable/c/a019b074903b3ad0a9726087efd0e8291452023b"
},
{
"url": "https://git.kernel.org/stable/c/ca03a7984a34f48085fd013e0d2cf4e6420b4acf"
},
{
"url": "https://git.kernel.org/stable/c/4b9a5458d02e214ef2b384124ca626e3e381d778"
}
],
"title": "fs: preserve ACL_DONT_CACHE state in forget_cached_acl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68149",
"datePublished": "2026-08-10T11:59:14.645Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-08-17T04:59:43.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-68149",
"date": "2026-10-10",
"epss": "0.00135",
"percentile": "0.02585"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/posix_acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "834ddf899484a2f23129080e8773bc04f4691d07",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "a019b074903b3ad0a9726087efd0e8291452023b",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "ca03a7984a34f48085fd013e0d2cf4e6420b4acf",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
},
{
"lessThan": "4b9a5458d02e214ef2b384124ca626e3e381d778",
"status": "affected",
"version": "facd61053cff100973921d4d45d47cf53c747ec6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/posix_acl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: preserve ACL_DONT_CACHE state in forget_cached_acl()\n\nThe ACL_DONT_CACHE state is meant to be a constant state for the inode\nfor filesystems that want to opt out of posix acl caching.\n\nCommit facd61053cff1 (\"fuse: fixes after adapting to new posix acl api\")\nused this facility to opt out of posix acl caching for fuse inodes with\nfuse server that does not negotiate FUSE_POSIX_ACL (fc-\u003eposix_acl).\n\nThe commit also takes care to gate the forget_all_cached_acls() call in\nfuse_set_acl() on fc-\u003eposix_acl because there is no need for it, but\nthere are other placed in fuse code which call forget_all_cached_acls()\nunconditional to fc-\u003eposix_acl and those cause the loss of the\nACL_DONT_CACHE state.\n\nThis is not only a functional bug. Properly timed, a get_acl() from this\nfuse filesystem can return a stale cached value, as was observed in tests,\nbecause set_acl() does not invalidate the unintentional acl cache.\n\nWe could fix this in fuse, but it actually makes no sense for the vfs\nhelper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so\nlet it not do that to fix fuse and future users of ACL_DONT_CACHE."
}
],
"id": "CVE-2026-68149",
"lastModified": "2026-08-17T05:18:15.053",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 5.8,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-10T13:20:00.863",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4b9a5458d02e214ef2b384124ca626e3e381d778"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/834ddf899484a2f23129080e8773bc04f4691d07"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/a019b074903b3ad0a9726087efd0e8291452023b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ca03a7984a34f48085fd013e0d2cf4e6420b4acf"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-31T11:17:26+00:00",
"cve": "CVE-2026-68149",
"id": "CVE-2026-68149",
"initial_release_date": "2026-08-10T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "93",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: fs: preserve ACL_DONT_CACHE state in forget_cached_acl()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68149.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "low",
"current_release_date": "2026-10-03T00:39:07Z",
"cve": "CVE-2026-68149",
"id": "CVE-2026-68149",
"initial_release_date": "2026-08-17T16:29:49Z",
"product_status:known_affected": "727",
"product_status:known_not_affected": "6",
"product_status:recommended": "252",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-68149",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68149.json",
"version": "11"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…