CVE-2026-68149

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the virtual file system (VFS) helper forget cached acl() where it fails to preserve the ACL DONT CACHE state. This state is intended to be constant for inodes in filesystems that opt out of POSIX ACL caching. In the FUSE filesystem, when a server does not negotiate FUSE POSIX ACL (via the fc->posix acl variable), the ACL DONT CACHE facility is used. However, certain calls to forget all cached acls() cause the loss of this state. This can lead to a situation where get acl() returns a stale cached value because set acl() does not invalidate the unintentionally created ACL cache.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.