CVE-2026-90263

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the btrfs filesystem, write operations including Access Control Lists (ACL) and extended attributes (xattr) should be denied when the read-only property is set to true. However, ACLs can still be modified because the code path for setting ACLs fails to verify if the root is read-only. This issue occurred after a check was removed from the btrfs setxattr trans() function without ensuring that all calling functions performed the necessary verification.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.