---
id: CVE-2026-64256
title: 'xfs: don''t wrap around quota ids in dqiterate'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: don't wrap around quota ids in dqiterate

  LOLLM noticed that q_id is an unsigned 32-bit variable.  If it happens
  to be set to XFS_DQ_ID_MAX due to a filesystem tha…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 <
    249e311c2ba392ceaf9ebfc145a46922946f069a
  - >-
    Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 <
    d1c4c40599c376aeb0c93068a2ae344e79ee4b90
  - >-
    Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 <
    2b14fe1e0924c6b901f4256456342569c5397abe
  - >-
    Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 <
    d766e4e5e85d829629c3ba503802fe1303d7b591
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:33:13.341232Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:31.667Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64256'
references:
  - url: 'https://git.kernel.org/stable/c/249e311c2ba392ceaf9ebfc145a46922946f069a'
  - url: 'https://git.kernel.org/stable/c/d1c4c40599c376aeb0c93068a2ae344e79ee4b90'
  - url: 'https://git.kernel.org/stable/c/2b14fe1e0924c6b901f4256456342569c5397abe'
  - url: 'https://git.kernel.org/stable/c/d766e4e5e85d829629c3ba503802fe1303d7b591'
tags:
  - cve.org
epss: 0.00159
epssPercentile: 0.05108
ingestedAt: '2026-11-06T16:57:43.214Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: don't wrap around quota ids in dqiterate

LOLLM noticed that q_id is an unsigned 32-bit variable.  If it happens
to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot
for ID_MAX, then this addition will truncate to zero and the iteration
starts over.  Fix this by casting to u64.

## Affected

- `Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 < 249e311c2ba392ceaf9ebfc145a46922946f069a`
- `Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 < d1c4c40599c376aeb0c93068a2ae344e79ee4b90`
- `Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 < 2b14fe1e0924c6b901f4256456342569c5397abe`
- `Linux >= 21d7500929c8a0b10e22a6755850c6f9a9280284 < d766e4e5e85d829629c3ba503802fe1303d7b591`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.