CVE-2026-64256 Details
Description
In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64.
A vulnerability in the Linux kernel's XFS file system can cause an incorrect handling of quota IDs during iteration. The issue arises because the quota ID is stored as an unsigned 32-bit variable. If it is set to the maximum value due to a filesystem having a corresponding dquot, the subsequent addition will truncate the value to zero, causing the iteration to restart. This vulnerability affects several versions of the Linux kernel.
Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed. The specific commit that resolves this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/249e311c2ba392ceaf9ebfc145a46922946f069a | kernel.org | Patch |
| https://git.kernel.org/stable/c/2b14fe1e0924c6b901f4256456342569c5397abe | kernel.org | Patch |
| https://git.kernel.org/stable/c/d1c4c40599c376aeb0c93068a2ae344e79ee4b90 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d766e4e5e85d829629c3ba503802fe1303d7b591 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.8, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 7.2 rc1 7.2 rc2 7.2 rc3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 25, 2026 | New CVE Received | kernel.org |