CVE-2026-68149

A flaw was found in the Linux kernel. The forget_cached_acl() helper function, intended to manage Access Control List (ACL) caching, incorrectly invalidates the ACL_DONT_CACHE state. This can lead to a Fuse (Filesystem in Userspace) filesystem returning stale cached ACL values. Consequently, this could result in incorrect access decisions or unintended information disclosure regarding file permissions.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local system access and is restricted to environments utilizing user-space filesystems (FUSE) that opt out of POSIX ACL caching. On standard enterprise deployments using native filesystems like XFS or ext4, this caching behavior is not exercised. Successful exploitation depends on precise timing conditions to retrieve stale access permission data, potentially leading to unauthorized local file access. Prior enterprise releases, including Red Hat Enterprise Linux 8, do not contain the affected caching logic and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.