CVE-2026-80529

xfs: don't swallow dquot recovery verification errors

State: Published
Severity: Not scored
Published: Aug 26, 2026
Updated: Aug 26, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't swallow dquot recovery verification errors

xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7880b1f0adef4d363f42d6bb42aab3211291351b to before e506e127fcb4e2bad1045805f1740b395eea9618Affected 3581868f51a2edb027a898988b5b5a4ba379ee55 to before 5b756fbb60b5d26063f46a11a3c7daa7eb616d79Affected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before a233b3362a3c7bf23f5143b4ef4b17ec337fcb4dAffected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before 38a4dbe588bd028a07a77dc5cee62ee3ce21e87dAffected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before 36a31b12540c0a0a3b77a01fda86de646f2961fbAffected 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before e2b4a856085e9bd939bde2dee0d08b1d41babde9Affected 6.1.128 to before 6.1.184Affected 6.6.17 to before 6.6.153Affected
LinuxLinux	6.7Affected before 6.7Not affected 6.1.184 through 6.1.Not affected 6.6.153 through 6.6.Not affected 6.12.105 through 6.12.Not affected 6.18.46 through 6.18.Not affected 7.1.10 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

7880b1f0adef4d363f42d6bb42aab3211291351b to before e506e127fcb4e2bad1045805f1740b395eea9618Affected
3581868f51a2edb027a898988b5b5a4ba379ee55 to before 5b756fbb60b5d26063f46a11a3c7daa7eb616d79Affected
9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before a233b3362a3c7bf23f5143b4ef4b17ec337fcb4dAffected
9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before 38a4dbe588bd028a07a77dc5cee62ee3ce21e87dAffected
9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before 36a31b12540c0a0a3b77a01fda86de646f2961fbAffected
9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 to before e2b4a856085e9bd939bde2dee0d08b1d41babde9Affected
6.1.128 to before 6.1.184Affected
6.6.17 to before 6.6.153Affected

LinuxLinux

6.7Affected
before 6.7Not affected
6.1.184 through 6.1.*Not affected
6.6.153 through 6.6.*Not affected
6.12.105 through 6.12.*Not affected
6.18.46 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.