Executive brief
The Linux kernel's btrfs filesystem allows users to modify POSIX ACLs (access control lists) on filesystems marked as read-only, bypassing the intended write-protection. This means an attacker with access to a read-only filesystem could escalate privileges or change file permissions despite the filesystem being flagged as immutable, potentially compromising data integrity guarantees and access control enforcement.
Technical details
This is a missing validation vulnerability in the btrfs POSIX ACL setting code path. The vulnerability occurs because the btrfs_set_acl() function in fs/btrfs/acl.c does not check whether the root filesystem is marked read-only before allowing ACL modifications. A previous code commit removed a read-only root check from btrfs_setxattr_trans(), but the removal was not complete across all callers. The fix adds a simple early return check using btrfs_root_readonly() that rejects ACL set operations with -EROFS (read-only filesystem error) if the root is flagged as read-only. Network access is not required; exploitation requires local filesystem access and ACL modification privileges. The patch is straightforward and has been merged into the Linux kernel stable tree.
Affected products
- Linux Linux kernel 5.0 and later (btrfs subsystem)
Timeline
- 2026-09-17: disclosed: CVE-2026-90263 published
- 2026-08-07: patched: Upstream fix committed to Linux kernel stable tree