The Linux kernel’s XFS module contains a flaw that silently discards verification failures of quota blocks during log recovery. When the recovery routine encounters an invalid dquot, it sets an error code but then jumps to a release routine that ignores the error, allowing the corrupted quota data to be written back to disk. This effectively corrupts the quota database and undermines the integrity of filesystem accounting.

The vulnerability affects the XFS filesystem implementation in all releases of the Linux kernel that contain the XFS module before the patch commit referenced in the advisory. The affected code is part of the core kernel filesystem stack, so any system running an unpatched Linux kernel with XFS support is potentially impacted. No specific kernel versions are listed, but all current releases lacking the fix are at risk.

The vulnerability is exercised during log recovery, which occurs at boot or when the kernel replays an XFS journal. The description does not state an attacker‐controlled trigger, but it is inferred that a privileged user who can cause a journal replay – for example by rebooting the system or by unmounting and remounting the filesystem – could force the damaged quota block to be written back to disk. The CVSS score of 5.5 indicates moderate risk. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Consequently, the primary threat is a loss of quota integrity rather than remote code execution or denial of service.