CVE-2026-99131

kernel: kernel: xfs: Disk quota bypass via improper capability check

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 3.1

Review impact separately from score.

Published · October 28, 2026

Updated · November 1, 2026

Description

A flaw was found in the XFS file system in the Linux kernel. An improper capability check verified a task's real credentials instead of its effective credentials, causing the system to treat certain attribute modifications as privileged. A user, particularly when modifying file ownership over a Network File System (NFS) client, can exploit this flaw to bypass storage quota accounting and exceed enforced disk quota limits.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-770 · Allocation of Resources Without Limits or Throttling