CVE-2026-64256 xfs: don't wrap around quota ids in dqiterate
An integer overflow in the XFS quota iteration logic can cause an infinite loop, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64256?
CVE-2026-64256 is a medium-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: don't wrap around quota ids in dqiterate
LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot for ID_MAX, then this addition will truncate to zero and the iteration starts over. Fix this by casting to u64.
Which versions are affected by CVE-2026-64256?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64256?
Apply the vendor's patch.
Is CVE-2026-64256 being exploited?
There is no known exploitation of CVE-2026-64256 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64256, DEBIAN-CVE-2026-64256, GHSA-wr2h-54m4-vp72, ROOT-OS-UBUNTU-2204-CVE-2026-64256, UBUNTU-CVE-2026-64256.