CVE-2026-80529

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/36a31b12540c0a0a3b77a01fda86de646f2961fb
https://git.kernel.org/stable/c/38a4dbe588bd028a07a77dc5cee62ee3ce21e87d
https://git.kernel.org/stable/c/5b756fbb60b5d26063f46a11a3c7daa7eb616d79
https://git.kernel.org/stable/c/a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d
https://git.kernel.org/stable/c/e2b4a856085e9bd939bde2dee0d08b1d41babde9
https://git.kernel.org/stable/c/e506e127fcb4e2bad1045805f1740b395eea9618

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-26 15:17

Updated : 2026-08-26 15:17

NVD link : CVE-2026-80529

Mitre link : CVE-2026-80529

CVE.ORG link : CVE-2026-80529

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-80529", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7880b1f0adef4d363f42d6bb42aab3211291351b", "lessThan": "e506e127fcb4e2bad1045805f1740b395eea9618", "versionType": "git"}, {"status": "affected", "version": "3581868f51a2edb027a898988b5b5a4ba379ee55", "lessThan": "5b756fbb60b5d26063f46a11a3c7daa7eb616d79", "versionType": "git"}, {"status": "affected", "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02", "lessThan": "a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d", "versionType": "git"}, {"status": "affected", "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02", "lessThan": "38a4dbe588bd028a07a77dc5cee62ee3ce21e87d", "versionType": "git"}, {"status": "affected", "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02", "lessThan": "36a31b12540c0a0a3b77a01fda86de646f2961fb", "versionType": "git"}, {"status": "affected", "version": "9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02", "lessThan": "e2b4a856085e9bd939bde2dee0d08b1d41babde9", "versionType": "git"}, {"status": "affected", "version": "6.1.128", "lessThan": "6.1.184", "versionType": "semver"}, {"status": "affected", "version": "6.6.17", "lessThan": "6.6.153", "versionType": "semver"}], "programFiles": ["fs/xfs/xfs_dquot_item_recover.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.105", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.46", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.10", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/xfs/xfs_dquot_item_recover.c"], "defaultStatus": "affected"}]}], "published": "2026-08-26T15:17:06.837", "references": [{"url": "https://git.kernel.org/stable/c/36a31b12540c0a0a3b77a01fda86de646f2961fb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/38a4dbe588bd028a07a77dc5cee62ee3ce21e87d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5b756fbb60b5d26063f46a11a3c7daa7eb616d79", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e2b4a856085e9bd939bde2dee0d08b1d41babde9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e506e127fcb4e2bad1045805f1740b395eea9618", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't swallow dquot recovery verification errors\n\nxlog_recover_dquot_commit_pass2() validates the recovered dquot with\nxfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps\nto out_release. But out_release unconditionally returns 0, so the\ncorruption error is discarded: the caller xlog_recover_items_pass2()\nsees success, log recovery proceeds as if the dquot were valid, and the\ncorrupt quota buffer can be written back to disk."}], "lastModified": "2026-08-26T15:17:06.837", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}