{"id":"CVE-2026-99131","revision":"8209564b8cf14992b4560df89c33962e","records":[{"revision":"8209564b8cf14992b4560df89c33962e","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2026-99131","aliases":[],"title":"xfs: fix capability check in xfs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix capability check in xfs\n\nAn user reported a bug where he managed to evade group's quota\nby changing a file's gid to a different group id the same user\nbelonged to, even though quotas were enforced on both gids and the\nfile's size was big enough to exceed the quota's hardlimit.\n\nCommit eba0549bc7d1 replaced a capable() call by a\nhas_capability_noaudit() to prevent unnecessary selinux audit messages.\nTurns out that both calls have slightly different semantics even though\ntheir documentation seems similar. Where in a nutshell:\n\ncapable() - Tests the task's effective credentials\nhas_ns_capability_noaudit() - Tests the task's real credentials\n\nThis most of the time has no practical difference but in some cases like\nchanging attrs (specifically group id in this case) through a NFS client\nthis will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively\nbypassing quota accounting checks.\n\nUsing instead ns_capable_noaudit() should fix this issue and prevent\nselinux audit messages.\n\nThis also fix the remaining calls to has_capability_noaudit()","state":0,"publishedAt":"2026-10-28T10:34:45.102+00:00","modifiedAt":"2026-10-30T12:42:04.291+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/xfs_fsmap.c\",\n                        \"fs/xfs/xfs_ioctl.c\",\n                        \"fs/xfs/xfs_iops.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"eba0549bc7d100691c13384b774346b8aa9cf9a9\",\n                            \"lessThan\": \"29f994db0447104a7a52fb6495193c80007cb66a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eba0549bc7d100691c13384b774346b8aa9cf9a9\",\n                            \"lessThan\": \"e84bfb08016496ec5ce09a5ef9c813f23c060781\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eba0549bc7d100691c13384b774346b8aa9cf9a9\",\n                            \"lessThan\": \"87881f816ab721d8a727cba20c36b9c71b489c8e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eba0549bc7d100691c13384b774346b8aa9cf9a9\",\n                            \"lessThan\": \"19a1a22029ad3ae3604c763af6bd1195cb73648f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eba0549bc7d100691c13384b774346b8aa9cf9a9\",\n                            \"lessThan\": \"7809ac0161c7c5f52ed348fb1ec683b2b454a83e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"eba0549bc7d100691c13384b774346b8aa9cf9a9\",\n                            \"lessThan\": \"e2f62a9744ebad3bcb6347a648e615026e9efeff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/xfs/xfs_fsmap.c\",\n                        \"fs/xfs/xfs_ioctl.c\",\n                        \"fs/xfs/xfs_iops.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/29f994db0447104a7a52fb6495193c80007cb66a","https://git.kernel.org/stable/c/e84bfb08016496ec5ce09a5ef9c813f23c060781","https://git.kernel.org/stable/c/87881f816ab721d8a727cba20c36b9c71b489c8e","https://git.kernel.org/stable/c/19a1a22029ad3ae3604c763af6bd1195cb73648f","https://git.kernel.org/stable/c/7809ac0161c7c5f52ed348fb1ec683b2b454a83e","https://git.kernel.org/stable/c/e2f62a9744ebad3bcb6347a648e615026e9efeff"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99131","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99131","identifiers":["CVE-2026-99131"]},"retained":false,"historicalAffected":[]}],"coverage":[]}