CVE-2026-90263
Description
A flaw was found in the Linux kernel's btrfs filesystem. A local user could bypass the intended read-only protection by setting a POSIX Access Control List (ACL) on a btrfs filesystem configured as read-only. This vulnerability occurs because the set_acl code path fails to properly check the filesystem's read-only status. Successful exploitation could lead to unauthorized modifications of file permissions on a supposedly immutable filesystem.
Statement
Btrfs POSIX ACL updates could bypass the read only property of a Btrfs root or subvolume because btrfs_set_acl did not check whether the root was readonly before changing ACL metadata. A local user who is otherwise allowed to set ACLs on an inode could modify access control metadata even though write operations on that readonly root should be rejected. For the CVSS the PR:L is selected because triggering requires a local user or local process with permission to attempt ACL changes, but not full administrative privileges in the vulnerable path. The issue is not network reachable and does not indicate memory corruption or kernel code execution. Impact is mainly a local integrity policy bypass. In the paranoid interpretation, confidentiality is limited because changed ACLs may affect who can read files, but there is no evidence of direct privilege escalation.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context; Gain Privileges or Assume Identity
When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
