CVE-2026-90263

A flaw was found in the Linux kernel's btrfs filesystem. A local user could bypass the intended read-only protection by setting a POSIX Access Control List (ACL) on a btrfs filesystem configured as read-only. This vulnerability occurs because the set_acl code path fails to properly check the filesystem's read-only status. Successful exploitation could lead to unauthorized modifications of file permissions on a supposedly immutable filesystem.

Btrfs POSIX ACL updates could bypass the read only property of a Btrfs root or subvolume because btrfs_set_acl did not check whether the root was readonly before changing ACL metadata. A local user who is otherwise allowed to set ACLs on an inode could modify access control metadata even though write operations on that readonly root should be rejected. For the CVSS the PR:L is selected because triggering requires a local user or local process with permission to attempt ACL changes, but not full administrative privileges in the vulnerable path. The issue is not network reachable and does not indicate memory corruption or kernel code execution. Impact is mainly a local integrity policy bypass. In the paranoid interpretation, confidentiality is limited because changed ACLs may affect who can read files, but there is no evidence of direct privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.