CVE-2026-68149 Linux CVE debrief

Who should care

Linux kernel users and administrators, as well as developers working with POSIX ACL caching and fuse filesystems, should review configurations and apply updates to ensure the fix is applied, monitor for potential stale cached values, and perform inventory checks to identify affected systems.

Technical summary

The vulnerability is related to the preservation of ACL_DONT_CACHE state in the forget_cached_acl() function. This state is meant to be a constant state for inodes in filesystems that opt out of POSIX ACL caching. A commit introduced a bug that causes the loss of this state, leading to potential stale cached values being returned. The issue was fixed by modifying the forget_cached_acl() function to not invalidate the ACL_DONT_CACHE state.

Defensive priority

Apply kernel updates to ensure the fix is applied, review and update ACL caching configurations, and monitor for potential stale cached values.

Recommended defensive actions

• Apply kernel updates to ensure the fix is applied
• Review and update ACL caching configurations
• Monitor for potential stale cached values
• Perform inventory checks to identify affected systems
• Implement compensating controls to mitigate potential impact

Evidence notes

The vulnerability was introduced by a commit that used the ACL_DONT_CACHE facility to opt out of POSIX ACL caching for fuse inodes. However, the commit did not properly handle the forget_all_cached_acls() call, leading to the loss of the ACL_DONT_CACHE state. The issue was fixed by modifying the forget_cached_acl() function to preserve this state.

Official resources