xfs: don't swallow dquot recovery verification errors (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.
References
- https://git.kernel.org/stable/c/e506e127fcb4e2bad1045805f1740b395eea9618
- https://git.kernel.org/stable/c/5b756fbb60b5d26063f46a11a3c7daa7eb616d79
- https://git.kernel.org/stable/c/a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d
- https://git.kernel.org/stable/c/38a4dbe588bd028a07a77dc5cee62ee3ce21e87d
- https://git.kernel.org/stable/c/36a31b12540c0a0a3b77a01fda86de646f2961fb
- https://git.kernel.org/stable/c/e2b4a856085e9bd939bde2dee0d08b1d41babde9
European references
- ENISA EUVD · EUVD-2026-66444
- GCVE · GCVE-0-2026-80529
CERT-FR advisories
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1232 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 7880b1f0adef4d363f42d6bb42aab3211291351b < e506e127fcb4e2bad1045805f1740b395eea9618 ; affected 3581868f51a2edb027a898988b5b5a4ba379ee55 < 5b756fbb60b5d26063f46a11a3c7daa7eb616d79 ; affected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 < a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d ; affected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 < 38a4dbe588bd028a07a77dc5cee62ee3ce21e87d ; affected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 < 36a31b12540c0a0a3b77a01fda86de646f2961fb ; affected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 < e2b4a856085e9bd939bde2dee0d08b1d41babde9 |
| Linux · Linux | affected 6.7 ; unaffected 0 < 6.7 ; unaffected 6.1.184 ≤ 6.1.* ; unaffected 6.6.153 ≤ 6.6.* ; unaffected 6.12.105 ≤ 6.12.* ; unaffected 6.18.46 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |