CVE-2026-97520

Received Received - Intake

GFS2 Quota Iterator Fix in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-09-28

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gfs2: move quota_init qc iterator increment Move qc++ from the loop body into the for-loop increment expression in gfs2_quota_init(). This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot handling in the loop body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-28

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97520

EUVD

EUVD-2026-86118

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	gfs2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a code change in the GFS2 file system's quota initialization function. The issue was that the iterator increment (qc++) was inside the loop body, mixing pointer advancement with duplicate-slot handling. The fix moves this increment into the for-loop's increment expression to make iterator progression explicit and clearer.

Detection Guidance

This vulnerability is specific to the Linux kernel's GFS2 filesystem quota initialization. Detection requires checking the kernel version and GFS2 implementation. Use commands like 'uname -r' to check kernel version and 'grep gfs2 /proc/filesystems' to verify GFS2 support. If patched, the kernel version should be 6.11 or later.

Impact Analysis

This vulnerability is unlikely to have a direct impact on end users. It is a code-level issue in the Linux kernel's GFS2 file system quota handling. The fix improves code clarity and maintainability but does not introduce a security flaw or functional bug that would affect system behavior or user data.

Compliance Impact

This vulnerability does not affect compliance with standards like GDPR or HIPAA. It is a minor code improvement without security implications or data exposure risks. Compliance posture remains unchanged as no regulatory controls are impacted by this change.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the gfs2 quota initialization issue. Monitor vendor advisories for kernel updates addressing CVE-2026-97520.

Hi! I’m here to help you understand CVE-2026-97520. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70