{"id":"CVE-2026-68149","title":"fs: preserve ACL_DONT_CACHE state in forget_cached_acl()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs: preserve ACL_DONT_CACHE state in forget_cached_acl()\n\nThe ACL_DONT_CACHE state is meant to be a constant state for the inode\nfor filesystems that want to opt out of…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf","Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < 834ddf899484a2f23129080e8773bc04f4691d07","Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < a019b074903b3ad0a9726087efd0e8291452023b","Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < ca03a7984a34f48085fd013e0d2cf4e6420b4acf","Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < 4b9a5458d02e214ef2b384124ca626e3e381d778","Linux 6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:44:54.722688Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:00.419Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68149","references":[{"url":"https://git.kernel.org/stable/c/b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf"},{"url":"https://git.kernel.org/stable/c/834ddf899484a2f23129080e8773bc04f4691d07"},{"url":"https://git.kernel.org/stable/c/a019b074903b3ad0a9726087efd0e8291452023b"},{"url":"https://git.kernel.org/stable/c/ca03a7984a34f48085fd013e0d2cf4e6420b4acf"},{"url":"https://git.kernel.org/stable/c/4b9a5458d02e214ef2b384124ca626e3e381d778"}],"tags":["cve.org"],"epss":0.00135,"epssPercentile":0.02657,"ingestedAt":"2026-10-16T17:24:46.845Z","slug":"CVE-2026-68149","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs: preserve ACL_DONT_CACHE state in forget_cached_acl()\n\nThe ACL_DONT_CACHE state is meant to be a constant state for the inode\nfor filesystems that want to opt out of posix acl caching.\n\nCommit facd61053cff1 (\"fuse: fixes after adapting to new posix acl api\")\nused this facility to opt out of posix acl caching for fuse inodes with\nfuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl).\n\nThe commit also takes care to gate the forget_all_cached_acls() call in\nfuse_set_acl() on fc->posix_acl because there is no need for it, but\nthere are other placed in fuse code which call forget_all_cached_acls()\nunconditional to fc->posix_acl and those cause the loss of the\nACL_DONT_CACHE state.\n\nThis is not only a functional bug. Properly timed, a get_acl() from this\nfuse filesystem can return a stale cached value, as was observed in tests,\nbecause set_acl() does not invalidate the unintentional acl cache.\n\nWe could fix this in fuse, but it actually makes no sense for the vfs\nhelper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so\nlet it not do that to fix fuse and future users of ACL_DONT_CACHE.\n\n## Affected\n\n- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf`\n- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < 834ddf899484a2f23129080e8773bc04f4691d07`\n- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < a019b074903b3ad0a9726087efd0e8291452023b`\n- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < ca03a7984a34f48085fd013e0d2cf4e6420b4acf`\n- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < 4b9a5458d02e214ef2b384124ca626e3e381d778`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}