The Linux kernel’s XFS module contains a flaw that silently discards verification failures of quota blocks during log recovery. When the recovery routine encounters an invalid dquot, it sets an error code but then jumps to a release routine that ignores the error, allowing the corrupted quota data to be written back to disk. This effectively corrupts the quota database and undermines the integrity of filesystem accounting.

The vulnerability affects the XFS filesystem implementation in all releases of the Linux kernel that contain the XFS module before the patch commit referenced in the advisory. The affected code is part of the core kernel filesystem stack, so any system running an unpatched Linux kernel with XFS support is potentially impacted. No specific kernel versions are listed, but all current releases lacking the fix are at risk.

The flaw can only be triggered during system boot or when the kernel replays an XFS journal, requiring privileged access to the filesystem. A local or privileged attacker who can force a journal replay, for example by rebooting or by remounting the filesystem, can cause corrupted quota information to be written back to disk. Because the corruption is silently accepted, the attacker can undermine quota accounting without immediate detection, leading to inaccurate quota enforcement or potential data loss. No publicly known exploits exist, the EPSS and CVSS scores are not provided, and the vulnerability is not listed in CISA KEV. The primary risk is data integrity and, at worst, availability of quota enforcement, but remote exploitation is unlikely without local privilege.