CVE-2026-80529 (GCVE-0-2026-80529)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-26 14:37
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7880b1f0adef4d363f42d6bb42aab3211291351b
Version: 3581868f51a2edb027a898988b5b5a4ba379ee55
Version: 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02
Version: 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02
Version: 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02
Version: 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02
Version: 6.1.128   ≤
Version: 6.6.17   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_dquot_item_recover.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e506e127fcb4e2bad1045805f1740b395eea9618",
              "status": "affected",
              "version": "7880b1f0adef4d363f42d6bb42aab3211291351b",
              "versionType": "git"
            },
            {
              "lessThan": "5b756fbb60b5d26063f46a11a3c7daa7eb616d79",
              "status": "affected",
              "version": "3581868f51a2edb027a898988b5b5a4ba379ee55",
              "versionType": "git"
            },
            {
              "lessThan": "a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d",
              "status": "affected",
              "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02",
              "versionType": "git"
            },
            {
              "lessThan": "38a4dbe588bd028a07a77dc5cee62ee3ce21e87d",
              "status": "affected",
              "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02",
              "versionType": "git"
            },
            {
              "lessThan": "36a31b12540c0a0a3b77a01fda86de646f2961fb",
              "status": "affected",
              "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02",
              "versionType": "git"
            },
            {
              "lessThan": "e2b4a856085e9bd939bde2dee0d08b1d41babde9",
              "status": "affected",
              "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.184",
              "status": "affected",
              "version": "6.1.128",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.153",
              "status": "affected",
              "version": "6.6.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_dquot_item_recover.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "6.1.128",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don\u0027t swallow dquot recovery verification errors\n\nxlog_recover_dquot_commit_pass2() validates the recovered dquot with\nxfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps\nto out_release.  But out_release unconditionally returns 0, so the\ncorruption error is discarded: the caller xlog_recover_items_pass2()\nsees success, log recovery proceeds as if the dquot were valid, and the\ncorrupt quota buffer can be written back to disk."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T14:37:07.390Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e506e127fcb4e2bad1045805f1740b395eea9618"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b756fbb60b5d26063f46a11a3c7daa7eb616d79"
        },
        {
          "url": "https://git.kernel.org/stable/c/a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/38a4dbe588bd028a07a77dc5cee62ee3ce21e87d"
        },
        {
          "url": "https://git.kernel.org/stable/c/36a31b12540c0a0a3b77a01fda86de646f2961fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2b4a856085e9bd939bde2dee0d08b1d41babde9"
        }
      ],
      "title": "xfs: don\u0027t swallow dquot recovery verification errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80529",
    "datePublished": "2026-08-26T14:37:07.390Z",
    "dateReserved": "2026-08-26T14:34:25.764Z",
    "dateUpdated": "2026-08-26T14:37:07.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.