Riskcovery

CVE-2026-64256

xfs: don't wrap around quota ids in dqiterate

State
Published
Severity
Not scored
Published
Jul 25, 2026
Updated
Aug 17, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't wrap around quota ids in dqiterate

LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 21d7500929c8a0b10e22a6755850c6f9a9280284 to before 249e311c2ba392ceaf9ebfc145a46922946f069aAffected
  • 21d7500929c8a0b10e22a6755850c6f9a9280284 to before d1c4c40599c376aeb0c93068a2ae344e79ee4b90Affected
  • 21d7500929c8a0b10e22a6755850c6f9a9280284 to before 2b14fe1e0924c6b901f4256456342569c5397abeAffected
  • 21d7500929c8a0b10e22a6755850c6f9a9280284 to before d766e4e5e85d829629c3ba503802fe1303d7b591Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.96 through 6.12.*Not affected
  • 6.18.39 through 6.18.*Not affected
  • 7.1.4 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.