CVE-2026-68149: Linux Kernel Privilege Escalation Flaw

CVE-2026-68149 Overview

CVE-2026-68149 affects the Linux kernel virtual filesystem (VFS) layer. The vulnerability resides in the forget_cached_acl() helper, which fails to preserve the ACL_DONT_CACHE state on inodes. Filesystems such as FUSE use this state to opt out of POSIX Access Control List (ACL) caching when the FUSE server does not negotiate FUSE_POSIX_ACL. Unconditional calls to forget_all_cached_acls() clear the sentinel and reintroduce caching. A subsequent get_acl() can return a stale cached value because set_acl() never invalidates the unintended cache entry. The result is inconsistent ACL enforcement on affected filesystems.

Critical Impact
Local users on affected Linux systems can observe stale POSIX ACL values on FUSE-backed filesystems, leading to inconsistent access control decisions and potential privilege boundary violations.

Affected Products

Linux kernel VFS layer (fs/posix_acl.c helper forget_cached_acl())
FUSE filesystems that do not negotiate FUSE_POSIX_ACL
Downstream distribution kernels prior to backporting the fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68149 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68149

Vulnerability Analysis

The Linux VFS exposes ACL_DONT_CACHE as a permanent inode ACL state for filesystems that manage POSIX ACLs themselves. Commit facd61053cff1 ("fuse: fixes after adapting to new posix acl api") used this flag to disable ACL caching on FUSE inodes when the FUSE server does not advertise FUSE_POSIX_ACL. That commit correctly gated one call site in fuse_set_acl() on fc->posix_acl, but other FUSE code paths still invoke forget_all_cached_acls() unconditionally. Each unconditional call overwrites the ACL_DONT_CACHE sentinel with a null cache pointer, silently re-enabling caching for inodes that were meant to remain uncached.

Once caching resumes, a later get_acl() populates the inode ACL cache from a value that the FUSE server may have already changed. Because set_acl() assumes the inode opted out of caching, it never invalidates the entry. Subsequent permission checks read the stale cached ACL and diverge from the authoritative value held by the FUSE server. The upstream fix moves the responsibility to the VFS helper itself so that forget_cached_acl() preserves the ACL_DONT_CACHE state instead of clearing it.

Root Cause

The VFS helper forget_cached_acl() treated ACL_DONT_CACHE as a normal cached pointer and replaced it during invalidation. This design defect made the opt-out flag transient rather than constant, contradicting its documented contract with filesystem drivers.

Attack Vector

A local unprivileged user with access to a FUSE mount can trigger the code paths that call forget_all_cached_acls() and then race an ACL read against a server-side ACL change. The stale cached ACL returned by the kernel can grant or deny access inconsistently with the FUSE server's intended policy.

No verified public proof-of-concept code is available. See the upstream kernel commits listed under Linux Kernel Commit 4b9a5458 and Linux Kernel Commit ca03a798 for the authoritative patch context.

Detection Methods for CVE-2026-68149

Indicators of Compromise

Discrepancies between ACLs reported by getfacl on a FUSE mount and the ACLs stored by the FUSE server backend.
Unexpected permission grants or denials on files served through FUSE filesystems that do not enable FUSE_POSIX_ACL.
Kernel builds predating the merge of commits 4b9a5458, 834ddf89, a019b074, b98fad81, or ca03a798.

Detection Strategies

Enumerate running kernel versions across the fleet and compare against the fixed stable releases published on kernel.org.
Audit FUSE-based mounts and confirm whether the FUSE server negotiates FUSE_POSIX_ACL; unnegotiated mounts are the affected surface.
Correlate access control anomalies with syscall telemetry for getxattr, setxattr, and fchmod on FUSE paths.

Monitoring Recommendations

Alert on unexpected EACCES or EPERM returns on FUSE mounts that previously succeeded, or vice versa.
Track kernel package versions with configuration management and flag hosts on unpatched branches.
Monitor local privilege changes on multi-tenant hosts that expose FUSE filesystems to untrusted users.

How to Mitigate CVE-2026-68149

Immediate Actions Required

Apply the stable kernel updates that include the forget_cached_acl() fix on all affected hosts.
Restrict local access to FUSE mounts where the server does not negotiate FUSE_POSIX_ACL.
Validate ACL enforcement on FUSE filesystems after patching by comparing kernel-visible ACLs to server-authoritative values.

Patch Information

The fix is available in the upstream Linux kernel through the following commits: Linux Kernel Commit 4b9a5458, Linux Kernel Commit 834ddf89, Linux Kernel Commit a019b074, Linux Kernel Commit b98fad81, and Linux Kernel Commit ca03a798. Deploy vendor-supplied kernel packages that incorporate these commits.

Workarounds

Where feasible, configure FUSE servers to negotiate FUSE_POSIX_ACL, which avoids the affected code path.
Disable FUSE mounts for untrusted local users until patched kernels are deployed.
Enforce stricter file permissions at the FUSE server layer so that stale kernel-cached ACLs cannot widen access.

bash

# Verify installed kernel version against fixed stable releases
uname -r

# Inspect FUSE mounts and identify servers that do not negotiate FUSE_POSIX_ACL
mount -t fuse,fuse3,fuseblk

# Compare kernel-visible ACLs to authoritative server ACLs after patching
getfacl /mnt/fuse/path/to/file