---
id: CVE-2026-68149
title: 'fs: preserve ACL_DONT_CACHE state in forget_cached_acl()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

  The ACL_DONT_CACHE state is meant to be a constant state for the inode
  for filesystems that want to opt out of…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= facd61053cff100973921d4d45d47cf53c747ec6 <
    b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf
  - >-
    Linux >= facd61053cff100973921d4d45d47cf53c747ec6 <
    834ddf899484a2f23129080e8773bc04f4691d07
  - >-
    Linux >= facd61053cff100973921d4d45d47cf53c747ec6 <
    a019b074903b3ad0a9726087efd0e8291452023b
  - >-
    Linux >= facd61053cff100973921d4d45d47cf53c747ec6 <
    ca03a7984a34f48085fd013e0d2cf4e6420b4acf
  - >-
    Linux >= facd61053cff100973921d4d45d47cf53c747ec6 <
    4b9a5458d02e214ef2b384124ca626e3e381d778
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:44:54.722688Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:00.419Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68149'
references:
  - url: 'https://git.kernel.org/stable/c/b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf'
  - url: 'https://git.kernel.org/stable/c/834ddf899484a2f23129080e8773bc04f4691d07'
  - url: 'https://git.kernel.org/stable/c/a019b074903b3ad0a9726087efd0e8291452023b'
  - url: 'https://git.kernel.org/stable/c/ca03a7984a34f48085fd013e0d2cf4e6420b4acf'
  - url: 'https://git.kernel.org/stable/c/4b9a5458d02e214ef2b384124ca626e3e381d778'
tags:
  - cve.org
epss: 0.00135
epssPercentile: 0.02652
ingestedAt: '2026-10-16T17:24:46.845Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

The ACL_DONT_CACHE state is meant to be a constant state for the inode
for filesystems that want to opt out of posix acl caching.

Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api")
used this facility to opt out of posix acl caching for fuse inodes with
fuse server that does not negotiate FUSE_POSIX_ACL (fc->posix_acl).

The commit also takes care to gate the forget_all_cached_acls() call in
fuse_set_acl() on fc->posix_acl because there is no need for it, but
there are other placed in fuse code which call forget_all_cached_acls()
unconditional to fc->posix_acl and those cause the loss of the
ACL_DONT_CACHE state.

This is not only a functional bug. Properly timed, a get_acl() from this
fuse filesystem can return a stale cached value, as was observed in tests,
because set_acl() does not invalidate the unintentional acl cache.

We could fix this in fuse, but it actually makes no sense for the vfs
helper forget_cached_acl() to invalidate the ACL_DONT_CACHE state, so
let it not do that to fix fuse and future users of ACL_DONT_CACHE.

## Affected

- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < b98fad81f1202b0eb26aacf3ff4cc7a21ed3b5bf`
- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < 834ddf899484a2f23129080e8773bc04f4691d07`
- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < a019b074903b3ad0a9726087efd0e8291452023b`
- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < ca03a7984a34f48085fd013e0d2cf4e6420b4acf`
- `Linux >= facd61053cff100973921d4d45d47cf53c747ec6 < 4b9a5458d02e214ef2b384124ca626e3e381d778`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.