CVE-2026-80529xfs: don't swallow dquot recovery verification errors
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7880b1f0adef4d363f42d6bb42aab3211291351b before e506e127fcb4e2bad1045805f1740b395eea9618; 3581868f51a2edb027a898988b5b5a4ba379ee55 builds before 5b756fbb60b5d26063f46a11a3c7daa7eb616d79; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before 38a4dbe588bd028a07a77dc5cee62ee3ce21e87d; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before 36a31b12540c0a0a3b77a01fda86de646f2961fb; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before e2b4a856085e9bd939bde2dee0d08b1d41babde9; from 6.1.128 before 6.1.184; from 6.6.17 before 6.6.153 | CNA record |
References
- https://git.kernel.org/stable/c/e506e127fcb4e2bad1045805f1740b395eea9618
- https://git.kernel.org/stable/c/5b756fbb60b5d26063f46a11a3c7daa7eb616d79
- https://git.kernel.org/stable/c/a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d
- https://git.kernel.org/stable/c/38a4dbe588bd028a07a77dc5cee62ee3ce21e87d
- https://git.kernel.org/stable/c/36a31b12540c0a0a3b77a01fda86de646f2961fb
- https://git.kernel.org/stable/c/e2b4a856085e9bd939bde2dee0d08b1d41babde9
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.