Linux Kernel EUVD-2026-55534

Exploitation requires all of the following: (1) local access to the target system with at minimum unprivileged user credentials (CVSS PR:L); (2) a FUSE filesystem must be mounted and accessible to the attacker, specifically one whose userspace FUSE server has NOT negotiated the FUSE_POSIX_ACL capability - systems where fc->posix_acl is true are entirely unaffected; (3) the attacker or a concurrent process must trigger a code path in FUSE that calls forget_all_cached_acls() without the fc->posix_acl gate (e.g., via set_acl() on the FUSE-mounted filesystem); (4) a get_acl() call must occur in the race window after ACL_DONT_CACHE is cleared but before the intended state is restored - the commit explicitly notes this requires 'proper timing.' Systems without any FUSE mounts are not affected. FUSE deployments with POSIX ACL negotiation enabled are not affected. The timing dependency meaningfully constrains reliable exploitation.

The CVSS 3.1 base score of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) frames this as a high-severity local ACL bypass. However, real-world exploitation probability is very low: EPSS is 0.18% (7th percentile), the vulnerability is absent from CISA KEV, and no public POC exists. The CVSS AC:L rating appears inconsistent with the description's explicit language that exploitation is 'properly timed,' which implies a race window and would warrant AC:H - this is a notable inconsistency between the official vector and the described behavior. The S:C (changed scope) may reflect that the kernel ACL state mediates security boundaries beyond the faulting process. Practically, only environments running FUSE filesystems backed by servers that have not negotiated FUSE_POSIX_ACL are in the vulnerable code path; systems without FUSE mounts or using FUSE with fc->posix_acl=true are entirely unaffected. This narrows real-world risk substantially below what the raw CVSS score suggests.

A local user on a Linux system running a FUSE filesystem whose userspace server does not negotiate FUSE_POSIX_ACL triggers a sequence of VFS ACL operations - such as calling set_acl() on a file - causing forget_all_cached_acls() to execute without the fc->posix_acl guard. This silently clears the ACL_DONT_CACHE sentinel on the inode, re-enabling ACL caching. If the attacker then issues a get_acl() call before the correct state is re-established, the kernel returns a stale cached ACL that may reflect more permissive access rights, allowing the attacker to read or modify files that current ACL policy should forbid. No public POC is available, but the bug is confirmed as reproducible in kernel CI testing per the commit description.