CVE-2026-64256: Linux Kernel Privilege Escalation Bug

CVE-2026-64256 Overview

CVE-2026-64256 is a numeric truncation vulnerability in the Linux kernel's XFS filesystem quota iteration logic. The flaw resides in the dqiterate function, where the q_id variable is declared as an unsigned 32-bit integer. When q_id reaches XFS_DQ_ID_MAX on a filesystem that contains a disk quota (dquot) for that maximum ID, arithmetic addition wraps around to zero. The iteration then restarts from the beginning instead of terminating cleanly. The fix casts q_id to u64 before the addition to prevent truncation. Upstream maintainers have merged the patch across multiple stable branches.

Critical Impact
A filesystem containing a dquot for XFS_DQ_ID_MAX triggers infinite iteration in dqiterate, causing quota subsystem misbehavior on affected Linux kernels.

Affected Products

Linux kernel (upstream) with XFS filesystem support
Stable Linux kernel branches receiving the referenced backports
Distributions shipping vulnerable XFS quota code prior to the fix

Discovery Timeline

2026-07-25 - CVE-2026-64256 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64256

Vulnerability Analysis

The vulnerability is a numeric truncation error [CWE-197] in the XFS disk quota iteration path. The dqiterate routine walks quota records by incrementing q_id, an unsigned 32-bit counter used to enumerate quota IDs. XFS defines XFS_DQ_ID_MAX as the upper bound for valid quota IDs. If a filesystem happens to contain a dquot record whose ID equals XFS_DQ_ID_MAX, the increment operation that advances q_id past this value overflows the 32-bit range and wraps back to zero. The loop then restarts enumeration from the first quota ID, producing an infinite iteration condition inside kernel context. The consequence is a functional defect in the quota subsystem rather than a memory safety issue, but it can lead to resource exhaustion and denial of service on the affected mount.

Root Cause

The root cause is the use of a 32-bit unsigned type (uint32_t) for arithmetic that must span the full inclusive range up to XFS_DQ_ID_MAX. Adding one to the maximum representable value truncates to zero, restarting the iteration rather than terminating it.

Attack Vector

Triggering the condition requires an XFS filesystem containing a dquot for the maximum quota ID. This is not a typical remote attack surface. A local user or administrator with the ability to create such a quota record, or a crafted filesystem image mounted by the kernel, would exercise the code path. Detailed attack vector metrics were not published in the NVD entry at the time of writing.

No verified proof-of-concept code has been published. The upstream fix replaces the 32-bit arithmetic with a u64 cast, ensuring the terminating comparison against XFS_DQ_ID_MAX succeeds without overflow. See the kernel git commits listed under references for the exact diff.

Detection Methods for CVE-2026-64256

Indicators of Compromise

Kernel threads or processes performing XFS quota operations stuck in dqiterate with sustained CPU usage.
Filesystem or system logs showing repeated quota enumeration activity without completion.
XFS mounts containing dquot entries with an ID equal to XFS_DQ_ID_MAX.

Detection Strategies

Audit kernel versions across the fleet and compare against the fixed commits: 249e311c, 2b14fe1e, d1c4c405, and d766e4e5.
Inventory XFS-formatted mounts and enumerate the maximum configured quota IDs using xfs_quota or repquota.
Correlate high kworker or xfs thread CPU utilization with concurrent quota administration commands.

Monitoring Recommendations

Alert on stalled or long-running quota tools such as xfs_quota, quotacheck, and repquota on XFS mounts.
Track kernel version drift and confirm stable branch updates include the referenced commits.
Baseline normal quota enumeration duration and flag deviations that suggest infinite iteration.

How to Mitigate CVE-2026-64256

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix for dqiterate referenced in the kernel git commits above.
Apply distribution vendor kernel updates as soon as they publish backports for their supported branches.
Restrict local privileged access to systems running unpatched XFS kernels until updates land.

Patch Information

The fix casts q_id to u64 inside dqiterate so the addition no longer truncates at the 32-bit boundary. The change is present in the following stable commits: 249e311c2ba3, 2b14fe1e0924, d1c4c40599c3, and d766e4e5e85d. Rebuild or install kernel packages that include these commits.

Workarounds

Avoid creating XFS quota entries at or near XFS_DQ_ID_MAX until the kernel is patched.
Do not mount untrusted XFS filesystem images that may contain crafted quota metadata.
Where feasible, disable XFS quotas on affected mounts until updated kernels are deployed.

bash

# Verify kernel version and check for the fix
uname -r
# Inspect installed kernel changelog for the referenced commits
rpm -q --changelog kernel | grep -E 'dqiterate|XFS_DQ_ID_MAX' || \
  dpkg -l | grep linux-image