Skip to main content

Linux Kernel CVE-2026-68149

| EUVDEUVD-2026-55534 HIGH
2026-08-10 Linux GHSA-wj9x-qhwh-xf9h
Information Disclosure Linux Suse
High
Disputed · 8.4 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
vuln.today AI
7.5 HIGH

AV:L and PR:L match local low-privilege access; AC:H reflects the 'properly timed' race window; S:C retained as kernel ACL state crosses FUSE-to-VFS security boundary; A:N as no availability impact described.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
3.6 LOW
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Red Hat
7.0 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:32 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.4 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 11:59 cve.org
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

The ACL_DONT_CACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching.

Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api") used this facility to opt out of posix acl caching for fuse inodes with fuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl).

The commit also takes care to gate the forget_all_cached_acls() call in fuse_set_acl() on fc->posix_acl because there is no need for it, but there are other placed in fuse code which call forget_all_cached_acls() unconditional to fc->posix_acl and those cause the loss of the ACL_DONT_CACHE state.

This is not only a functional bug. Properly timed, a get_acl() from this fuse filesystem can return a stale cached value, as was observed in tests, because set_acl() does not invalidate the unintentional acl cache.

We could fix this in fuse, but it actually makes no sense for the vfs helper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so let it not do that to fix fuse and future users of ACL_DONT_CACHE.

AnalysisAI

ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.

Technical ContextAI

The Linux VFS layer uses a sentinel constant ACL_DONT_CACHE on an inode to indicate that its backing filesystem has permanently opted out of POSIX ACL caching. FUSE introduced this opt-out via commit facd61053cff1 for userspace FUSE servers that do not negotiate the FUSE_POSIX_ACL capability (stored in fc->posix_acl). The bug is in the VFS helper forget_cached_acl(): when called unconditionally by FUSE code paths that do not gate on fc->posix_acl (such as certain set_acl() flows), the helper overwrites the ACL_DONT_CACHE sentinel with NULL, silently re-enabling kernel ACL caching on that inode. A subsequent get_acl() then returns whatever is now in the (unintentionally populated) cache - potentially a stale, more permissive ACL from a prior access control state. No CWE is formally assigned; the closest applicable classes are CWE-362 (race condition on shared resource) and CWE-672 (use of resource after expiration/release). Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 or later. All patch commits are available via the Linux stable git tree at the references above. Where kernel patching is not immediately feasible, administrators should restrict FUSE filesystem mounting to trusted users by controlling access to CAP_SYS_ADMIN or leveraging mount namespaces and user namespace restrictions - this limits who can place a vulnerable FUSE mount and reduces the exploitable population; the trade-off is that legitimate FUSE-based applications (sshfs, gocryptfs, overlayfs variants) may require reconfiguration. A second workaround is to ensure that all deployed FUSE servers negotiate FUSE_POSIX_ACL, since fc->posix_acl=true is not affected by this bug; this requires auditing the FUSE server configuration and may not be possible with all userspace FUSE implementations.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68149 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy