Look up another CVE · open CVE-2026-68149 in the interactive tracker
CVE-2026-68149
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem fs. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-68149 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.101-1 | Update the kernel and reboot. Fixed in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The ACL_DONT_CACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api") used this facility to opt out of posix acl caching for fuse inodes with fuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl). The commit also takes care to gate the forget_all_cached_acls() call in fuse_set_acl() on fc->posix_acl because there is no need for it, but there are other placed in fuse code which call forget_all_cached_acls() unconditional to fc->posix_acl and those cause the loss of the ACL_DONT_CACHE state. This is not only a functional bug. Properly timed, a get_acl() from this fuse filesystem can return a stale cached value, as was observed in tests, because set_acl() does not invalidate the unintentional acl cache. We could fix this in fuse, but it actually makes no sense for the vfs helper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so let it not do that to fix fuse and future users of ACL_DONT_CACHE.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/posix_acl.c
- What this is
- FILESYSTEMS (VFS and infrastructure)MAINTAINERS section matched on fs/* · linux-fsdevel@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_FS_POSIX_ACL /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_FS_POSIX_ACL
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Nsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.2 | 6.6.148 | b98fad81f120 |
| 6.2 | 6.12.101 | 834ddf899484 |
| 6.2 | 6.18.42 | a019b074903b |
| 6.2 | 7.1.6 | ca03a7984a34 |
| 6.2 | 7.2 | 4b9a5458d02e |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires local VFS syscalls (getxattr, statx, open, read, write) on a FUSE-backed mount; the bug is in kernel ACL caching, not in a network protocol handler.
- AC:LAttack complexity, low
- The attacker controls the full trigger sequence (stat/getattr to clear ACL_DONT_CACHE, getxattr to populate cache, ACL change, then access) and can drive timing with concurrent threads without depending on uncontrollable system state.
- PR:LPrivileges required, low
- Any unprivileged local user who can mount or access a FUSE filesystem (fusermount, user namespaces, virtio-fs/SSHFS mounts with allow_other) can reach the vulnerable code paths on files within that mount.
- UI:NUser interaction, none
- Exploitation is fully attacker-driven through syscall sequences on the FUSE mount; no victim click, mount action, or other interactive cooperation is required beyond routine filesystem use.
- S:CScope, changed
- On virtio-fs/Kata/Firecracker shared host directories, stale kernel ACL enforcement can let a guest/container process access host-exported files beyond the permissions the host administrator intended, crossing that isolation boundary.
- C:HConfidentiality impact, high
- Stale permissive cached ACLs cause check_acl()/posix_acl_permission() to authorize reads of files that should be denied after ACL tightening, enabling unauthorized disclosure of protected file contents on default_permissions mounts.
- I:HIntegrity impact, high
- The same stale ACL bypass lets an attacker obtain write permission enforced by the kernel VFS on files whose ACLs were subsequently restricted, enabling unauthorized modification of protected data.
- A:NAvailability impact, none
- This is a stale-cache logic bug with no memory corruption, kernel crash, panic, or hang; observed impact is incorrect ACL enforcement and authorization bypass, not availability loss.