CVE-2025-40196

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs: quota: create dedicated workqueue for quota_release_work

There is a kernel panic due to WARN_ONCE when panic_on_warn is set.

This issue occurs when writeback is triggered due to sync call for an

opened file(ie, writeback reason is WB_REASON_SYNC). When f2fs balance

is needed at sync path, flush for quota_release_work is triggered.

By default quota_release_work is queued to "events_unbound" queue which

does not have WQ_MEM_RECLAIM flag. During f2fs balance "writeback"

workqueue tries to flush quota_release_work causing kernel panic due to

MEM_RECLAIM flag mismatch errors.

This patch creates dedicated workqueue with WQ_MEM_RECLAIM flag

for work quota_release_work.

------------[ cut here ]------------

WARNING: CPU: 4 PID: 14867 at kernel/workqueue.c:3721 check_flush_dependency+0x13c/0x148

Call trace:

check_flush_dependency+0x13c/0x148

__flush_work+0xd0/0x398

flush_delayed_work+0x44/0x5c

dquot_writeback_dquots

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References