Medium 5.5Published Apr 24, 2026

CVE-2026-31556xfs: scrub: unlock dquot before early return in quota scrub

Updated under an hour ago (Oct 27, 2026, 11:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfs: scrub: unlock dquot before early return in quota scrub xchk_quota_item can return early after calling xchk_fblock_process_error. When that helper returns false, the function returned immediately without dropping dq->q_qlock, which can leave the dquot lock held and risk lock leaks or deadlocks in later quota operations. Fix this by unlocking dq->q_qlock before the early return.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7d1f0e167a067ed741dec08b7614d76893422b04 before e822f535273af0e8968eab7acc0cea0b90dd25af; 7d1f0e167a067ed741dec08b7614d76893422b04 builds before 3b0c3414b308e6822cda90bf99f7eac94d4cca2b; from 7d1f0e167a067ed741dec08b7614d76893422b04 before d128fc0c5c2b19224927d4fd2a46c2fe6a1f606f; from 7d1f0e167a067ed741dec08b7614d76893422b04 before 268378b6ad20569af0d1957992de1c8b16c6e900	CNA record
linux linux_kernel linux:linux_kernel	from 6.8.1 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11; 6.8; 7.0; 7.0; 7.0; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e822f535273af0e8968eab7acc0cea0b90dd25af	patch
https://git.kernel.org/stable/c/3b0c3414b308e6822cda90bf99f7eac94d4cca2b	patch
https://git.kernel.org/stable/c/d128fc0c5c2b19224927d4fd2a46c2fe6a1f606f	patch
https://git.kernel.org/stable/c/268378b6ad20569af0d1957992de1c8b16c6e900	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.