Executive brief
The Linux kernel's XFS file system contains a flaw in its crash recovery logic for quota disk blocks. When the recovery process detects a corrupted quota block, it silently ignores the error and proceeds as if the block were valid, allowing the corrupted data to be written back to the disk. This can result in file system corruption and potential data loss during recovery from an unclean shutdown.
Technical details
The vulnerability exists in the xlog_recover_dquot_commit_pass2() function in the XFS code. When xfs_dqblk_verify() detects corruption in a recovered quota disk block, the function sets error = -EFSCORRUPTED and jumps to the out_release label. However, the out_release cleanup path unconditionally returns 0 (success), causing the corruption error to be discarded. The caller, xlog_recover_items_pass2(), receives a success status and continues log recovery, allowing the corrupt quota buffer to be written back to disk. The fix is a one-line change: return the actual error code instead of always returning 0 from the out_release path. The vulnerability affects Linux kernel versions starting from v6.8 where the original dquot recovery validation was introduced (commit 9c235dfc3d3f). No known public exploits exist, as this is a data integrity issue rather than a direct security vulnerability.
Affected products
- Linux Linux kernel v6.8 and later
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched