Medium severity5.5NVD Advisory· Published Jul 25, 2026· Updated Aug 17, 2026

CVE-2026-64256

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't wrap around quota ids in dqiterate

LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64.

Affected products

Linux/Kernel5 versions
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.8,<6.12.96
- cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*
- (no CPE)
osv-coords4 versions
pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed pkg:apk/chainguard/linux-gcp-6.18 pkg:apk/chainguard/linux-gcp-6.18-bootc pkg:linux/kernel
< 7.1.7-1.1+ 3 more
- (no CPE)range: < 7.1.7-1.1
- (no CPE)range: < 6.18.44-r0
- (no CPE)range: < 6.18.44-r0
- (no CPE)range: >= 6.8.0, < 6.12.96

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000

CVE-2026-64256

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions