Based on the description, it is inferred that the Linux kernel function responsible for clearing cached access control lists incorrectly drops the ACL_DONT_CACHE flag when a cached ACL is forgotten. Since this flag is intended to opt out of POSIX ACL caching for filesystems such as FUSE, omitting it allows subsequent calls to get_acl() to return a stale ACL value; the filesystem may then grant access or deny operations that do not reflect the true permissions. The bug is thus a functional flaw that can lead to improper access control.

All Linux kernels that include the fuse filesystem driver are affected; the issue exists wherever the kernel’s forget_cached_acl() and related fuse helpers are used. No specific version range is provided, so any release that ships the vulnerable code path is potentially impacted.

Based on the description, it is inferred that the likely attack vector involves a process that can create, manipulate, or read files on a FUSE mount whose server does not negotiate POSIX ACL support. The kernel’s forget_cached_acl() can unintentionally clear the ACL_DONT_CACHE state, allowing an attacker to cause ACL checks to succeed or fail based on cached stale data, which could lead to privilege escalation or denial of service. The flaw requires local filesystem operations, and the EPSS score is < 1%, indicating a very low probability of exploitation. The CVSS score of 8.4 reflects high severity, and the vulnerability is not listed in CISA KEV catalog, suggesting that widespread exploitation has not been documented.