SB20261029193 - Incorrect authorization in Linux kernel xfs

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect authorization (CVE-ID: CVE-2026-99131)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass enforced group disk quota limits.

The vulnerability exists due to incorrect capability checks against real rather than effective credentials in the Linux kernel XFS filesystem when processing file attribute changes through an NFS client. A remote user can change a file's group ID to another group they belong to, causing quota handling to use XFS_QMOPT_FORCE_RES to bypass quota accounting checks even when the file exceeds the destination group's hard limit.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/19a1a22029ad3ae3604c763af6bd1195cb73648f
• https://git.kernel.org/stable/c/7809ac0161c7c5f52ed348fb1ec683b2b454a83e
• https://git.kernel.org/stable/c/e2f62a9744ebad3bcb6347a648e615026e9efeff