Skip to main content

Linux Kernel CVE-2026-64256

| EUVDEUVD-2026-48968 MEDIUM
2026-07-25 Linux GHSA-wr2h-54m4-vp72
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.7 MEDIUM

Attack Complexity raised to High because triggering the wraparound requires a dquot at XFS_DQ_ID_MAX, a specific filesystem state absent from all default configurations.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 16:19 vuln.today
CVSS changed
Aug 12, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:49 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:49 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't wrap around quota ids in dqiterate

LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64.

AnalysisAI

XFS filesystem quota iteration in the Linux kernel wraps a 32-bit quota ID back to zero when a disk quota entry (dquot) exists at XFS_DQ_ID_MAX, producing an infinite loop and local denial of service. Systems running Linux 6.8 and later with XFS quotas enabled are vulnerable if a dquot is present at the maximum 32-bit ID boundary (0xFFFFFFFF). No active exploitation has been identified; patched releases 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 are available from the kernel stable tree.

Technical ContextAI

The defect lives in the XFS filesystem quota iterator (dqiterate) within the Linux kernel. XFS manages per-user, per-group, and per-project disk usage via disk quota records (dquots) addressed by unsigned 32-bit IDs. CPE data (cpe:2.3:a:linux:linux:*) confirms all Linux kernel builds with XFS support are in scope from the introducing commit 21d7500929c8a0b10e22a6755850c6f9a9280284. During quota enumeration, the iterator increments the 32-bit variable q_id to advance to the next dquot; when the filesystem contains a dquot at XFS_DQ_ID_MAX (4294967295), adding 1 wraps q_id silently back to 0 and restarts enumeration indefinitely. The fix casts q_id to u64 before the increment. Although the intelligence tags label this 'Information Disclosure,' the CVSS vector (C:N/I:N/A:H) and the description confirm a pure availability impact, consistent with CWE-190 (Integer Overflow or Wraparound) even though CWE is listed as N/A in the source data.

RemediationAI

Upgrade to a patched kernel release: Linux 6.12.96, 6.18.39, 7.1.4, or 7.2-rc4 contain the fix; distribution maintainers tracking these stable branches will carry the correction through their normal update channels. The upstream fix commits are indexed at git.kernel.org as listed in the references. If an immediate kernel upgrade is not operationally feasible, administrators can audit XFS filesystems using xfs_quota tooling to confirm no dquot exists at ID 4294967295; removing any such entry eliminates the wraparound trigger without requiring a kernel change, though this requires filesystem-level maintenance. Disabling XFS quota enforcement entirely on systems where quota tracking is non-essential would also remove the vulnerable code path, at the cost of losing quota policy enforcement. No side effects are associated with the upstream patch itself.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

CVE-2026-64256 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy