https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 04:38:56 +0000 https://db.gcve.eu/vuln/cve-2026-99131 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfs: fix capability check in xfs</p> <p>An user reported a bug where he managed to evade group&#39;s quota by changing a file&#39;s gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file&#39;s size was big enough to exceed the quota&#39;s hardlimit.</p> <p>Commit eba0549bc7d1 replaced a capable() call by a has_capability_noaudit() to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell:</p> <p>capable() - Tests the task&#39;s effective credentials has_ns_capability_noaudit() - Tests the task&#39;s real credentials</p> <p>This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks.</p> <p>Using instead ns_capable_noaudit() should fix this issue and prevent selinux audit messages.</p> <p>This also fix the remaining calls to has_capability_noaudit()</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfs: fix capability check in xfs</p> <p>An user reported a bug where he managed to evade group&#39;s quota by changing a file&#39;s gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file&#39;s size was big enough to exceed the quota&#39;s hardlimit.</p> <p>Commit eba0549bc7d1 replaced a capable() call by a has_capability_noaudit() to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell:</p> <p>capable() - Tests the task&#39;s effective credentials has_ns_capability_noaudit() - Tests the task&#39;s real credentials</p> <p>This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks.</p> <p>Using instead ns_capable_noaudit() should fix this issue and prevent selinux audit messages.</p> <p>This also fix the remaining calls to has_capability_noaudit()</p> https://db.gcve.eu/vuln/cve-2026-99131