Linux kernel XFS: Incorrect capability check allows quota bypass
Summary
The XFS filesystem in the Linux kernel checks real instead of effective credentials when a file's attributes, such as its group ID, are changed. A user who can change file ownership, including through an NFS client, can move a file to another group they belong to and evade group quota enforcement. The described impact is quota bypass, and the record does not describe confidentiality loss. Exposure is mainly on multi-user Linux systems and NFS servers that use XFS with group quotas.
Affected
- Linux kernel from commit eba0549bc7d1 (introduced in 5.18) up to the fixed versions below
- Per the CVE record, Linux 7.3 and later are unaffected; the affected range is not fully confirmed against NVD
- Distribution kernel packages: Unknown.
Fixed in
- Linux 6.1.191
- Linux 6.6.161
- Linux 6.12.115
- Linux 6.18.59
- Linux 7.2.13
- Distribution kernel packages: Unknown.
Workaround
Unknown.
Exploitation
- No public proof of concept or exploitation in the wild was found in the sources checked.
- Not listed in CISA KEV in the sources checked.
- EPSS: about 0.19 %.
Our recommendation
- Install the kernel update from your distribution or the fixed stable kernel, then reboot.
- Check whether you use XFS with group quotas or NFS exports, and restrict who can change file ownership there.
- Verify the CVSS vector in NVD once analysis is complete, because the described impact does not show confidentiality loss.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubuntu Security: CVE-2026-99131 ubuntu.com
- Stable kernel commit 19a1a22029ad git.kernel.org
- Stable kernel commit 29f994db0447 git.kernel.org
- Stable kernel commit 7809ac0161c7 git.kernel.org
- Stable kernel commit 87881f816ab7 git.kernel.org
- Stable kernel commit e2f62a9744eb git.kernel.org
- Stable kernel commit e84bfb080164 git.kernel.org
- OSV: BELL-CVE-2026-99131 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:46.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the file's size was big enough to exceed the quota's hardlimit. Commit eba0549bc7d1 replaced a capable() call by a has_capability_noaudit() to prevent unnecessary selinux audit messages. Turns out that both calls have slightly different semantics even though their documentation seems similar. Where in a nutshell: capable() - Tests the task's effective credentials has_ns_capability_noaudit() - Tests the task's real credentials This most of the time has no practical difference but in some cases like changing attrs (specifically group id in this case) through a NFS client this will allow the quota code to use XFS_QMOPT_FORCE_RES, effectively bypassing quota accounting checks. Using instead ns_capable_noaudit() should fix this issue and prevent selinux audit messages. This also fix the remaining calls to has_capability_noaudit()
NVD references (6)
- https://git.kernel.org/stable/c/19a1a22029ad3ae3604c763af6bd1195cb73648f
- https://git.kernel.org/stable/c/29f994db0447104a7a52fb6495193c80007cb66a
- https://git.kernel.org/stable/c/7809ac0161c7c5f52ed348fb1ec683b2b454a83e
- https://git.kernel.org/stable/c/87881f816ab721d8a727cba20c36b9c71b489c8e
- https://git.kernel.org/stable/c/e2f62a9744ebad3bcb6347a648e615026e9efeff
- https://git.kernel.org/stable/c/e84bfb08016496ec5ce09a5ef9c813f23c060781
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.