A vulnerability in the Linux kernel filesystem layer allows local authenticated users to potentially bypass access controls due to stale ACL caching, posing a high risk to system integrity.

The vulnerability resides in the forget_cached_acl function, which improperly invalidates the ACL_DONT_CACHE state for inodes. This allows an authenticated local attacker to trigger a race condition where get_acl returns stale, incorrect cached values, effectively bypassing intended access restrictions.

The exploitation of this flaw allows an attacker to gain unauthorized access to files or directories that should be restricted, violating the principle of least privilege. Given the CVSS score of 8.4, this vulnerability is categorized as high severity because it enables scope escalation and potential integrity compromise within the kernel environment, which could lead to broader system-level exploitation.

Immediate Action: Update the Linux kernel to the corrected versions, specifically 6.6.148, 6.12.101, 6.18.42, or 7.1.6, depending on your distribution branch.

Proactive Monitoring: Monitor system logs for unexpected filesystem errors or unusual access patterns involving FUSE-mounted filesystems.

Compensating Controls: Restrict local access to the system to authorized users only, as the attack requires local access to the filesystem where the FUSE mount is present.

Public Exploit Available: Unknown

Organizations should prioritize patching their Linux kernel environments to the identified stable releases. Because this vulnerability involves fundamental filesystem logic that can lead to unauthorized data access, applying these updates is critical to maintaining the security posture of the host operating system.