Executive brief
A bug in the Linux kernel's XFS file system could cause infinite loops when checking disk quotas on extremely large storage volumes. This occurs when a specific internal identifier reaches its maximum value, causing the system to restart its count from zero instead of finishing. While primarily a technical error, it could lead to system instability or performance issues during maintenance tasks.
Technical details
An integer overflow vulnerability exists in the XFS file system's dquot iteration logic within `fs/xfs/scrub/dqiterate.c`. The variable `q_id` is an unsigned 32-bit integer; when it reaches `XFS_DQ_ID_MAX`, the increment operation `dq->q_id + 1` wraps around to zero. This causes the iteration process to restart indefinitely. The fix involves casting the variable to a 64-bit unsigned integer (`u64`) to prevent truncation. This issue affects the 'scrub' functionality introduced or modified in kernel version 6.8.
Affected products
- Linux Linux Kernel 6.8 to 7.2-rc4
Timeline
- 2026-07-13: patched: Initial fix commit by Darrick J. Wong
- 2026-07-25: disclosed: CVE published to NVD dataset