CVE-2026-80529

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't swallow dquot recovery verification errors

xlog_recover_dquot_commit_pass2() validates the recovered dquot with

xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps

to out_release. But out_release unconditionally returns 0, so the

corruption error is discarded: the caller xlog_recover_items_pass2()

sees success, log recovery proceeds as if the dquot were valid, and the

corrupt quota buffer can be written back to disk.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References