SB20260812396 - Improper control of a resource through its lifetime in Linux kernel fs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260812396

SB20260812396 - Improper control of a resource through its lifetime in Linux kernel fs

Published: August 12, 2026

Security Bulletin ID SB20260812396
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68149)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass intended ACL handling and retain stale access control list data.

The vulnerability exists due to improper cache state handling in posix ACL caching for fuse inodes in the Linux kernel when invalidating cached ACL entries. A local user can trigger ACL updates and cache invalidation conditions to bypass intended ACL handling and retain stale access control list data.

The issue affects fuse filesystems that opt out of POSIX ACL caching when the fuse server does not negotiate POSIX ACL support.


Remediation

Install update from vendor's website.

References