In the Linux kernel, the following vulnerability has been resolved:

xfs: don't wrap around quota ids in dqiterate

LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens
to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot
for ID_MAX, then this addition will truncate to zero and the iteration
starts over. Fix this by casting to u64.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
21d7500929c8a0b10e22a6755850c6f9a9280284 affected < 249e311c2ba392ceaf9ebfc145a46922946f069a
21d7500929c8a0b10e22a6755850c6f9a9280284 affected < d1c4c40599c376aeb0c93068a2ae344e79ee4b90
21d7500929c8a0b10e22a6755850c6f9a9280284 affected < 2b14fe1e0924c6b901f4256456342569c5397abe
21d7500929c8a0b10e22a6755850c6f9a9280284 affected < d766e4e5e85d829629c3ba503802fe1303d7b591
Linux Linux affected
Version Status Constraints
6.8 affected —
0 unaffected < 6.8
6.12.96 unaffected ≤ 6.12.*
6.18.39 unaffected ≤ 6.18.*
7.1.4 unaffected ≤ 7.1.*
7.2-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/249e311c2ba392ceaf9ebfc145a46922946f069a cve-icon
https://git.kernel.org/stable/c/2b14fe1e0924c6b901f4256456342569c5397abe cve-icon
https://git.kernel.org/stable/c/d1c4c40599c376aeb0c93068a2ae344e79ee4b90 cve-icon
https://git.kernel.org/stable/c/d766e4e5e85d829629c3ba503802fe1303d7b591 cve-icon
History

Sun, 26 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota ids in dqiterate LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64.
Title xfs: don't wrap around quota ids in dqiterate
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-25T08:49:08.676Z

Reserved: 2026-07-19T15:36:31.773Z

Link: CVE-2026-64256

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T03:00:08Z

Weaknesses