Executive brief
A vulnerability in the Linux kernel's file system quota management can cause a system-wide crash (kernel panic). This occurs during specific file synchronization operations, particularly when using the F2FS file system, due to a technical mismatch in how the system handles background memory tasks. An exploit would result in a complete loss of availability for the affected server or device.
Technical details
A vulnerability in the Linux kernel's fs/quota/dquot.c component leads to a kernel panic when 'panic_on_warn' is enabled. The issue stems from a workqueue dependency violation where the 'writeback' workqueue (which has the WQ_MEM_RECLAIM flag) attempts to flush 'quota_release_work'. Because 'quota_release_work' was historically queued to the default 'system_unbound_wq' (which lacks WQ_MEM_RECLAIM), the kernel triggers a WARN_ONCE due to the memory reclaim flag mismatch during F2FS balance operations. This is triggered during WB_REASON_SYNC writeback paths. The fix involves creating a dedicated workqueue for quota releases that includes the WQ_MEM_RECLAIM flag.
Affected products
- Linux Linux Kernel 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64, 6.12.4, 6.13
Timeline
- 2025-11-12: advisory: CVE-2025-40196 published
- 2025-09-03: patched: Fix committed to mainline kernel by Jan Kara
References
- https://git.kernel.org/stable/c/72b7ceca857f38a8ca7c5629feffc63769638974
- https://git.kernel.org/stable/c/8a09a62f0c8c6123c2f1864ed6d5f9eb144afaf0
- https://git.kernel.org/stable/c/8df2eedd371a1c24ecc4283581299d7737dfcd06
- https://git.kernel.org/stable/c/f12039df1515d5daf7d92e586ece5cefeb39561b
- https://git.kernel.org/stable/c/f846eacde280ecc3daedfe001580e3033565179e