Incorrect authorization in Linux kernel - CVE-2026-99131
Published: October 29, 2026
Vulnerability identifier: #VU158468
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99131
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass enforced group disk quota limits.
The vulnerability exists due to incorrect capability checks against real rather than effective credentials in the Linux kernel XFS filesystem when processing file attribute changes through an NFS client. A remote user can change a file's group ID to another group they belong to, causing quota handling to use XFS_QMOPT_FORCE_RES to bypass quota accounting checks even when the file exceeds the destination group's hard limit.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99131
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2