In the Linux kernel, the following vulnerability has been resolved:
fs: quota: create dedicated workqueue for quotareleasework
There is a kernel panic due to WARNONCE when panicon_warn is set.
This issue occurs when writeback is triggered due to sync call for an opened file(ie, writeback reason is WBREASONSYNC). When f2fs balance is needed at sync path, flush for quotareleasework is triggered. By default quotareleasework is queued to "eventsunbound" queue which does not have WQMEMRECLAIM flag. During f2fs balance "writeback" workqueue tries to flush quotareleasework causing kernel panic due to MEMRECLAIM flag mismatch errors.
This patch creates dedicated workqueue with WQMEMRECLAIM flag for work quotareleasework.
------------[ cut here ]------------ WARNING: CPU: 4 PID: 14867 at kernel/workqueue.c:3721 checkflushdependency+0x13c/0x148 Call trace: checkflushdependency+0x13c/0x148 _flushwork+0xd0/0x398 flushdelayedwork+0x44/0x5c dquotwritebackdquots+0x54/0x318 f2fsdoquotasync+0xb8/0x1a8 f2fswritecheckpoint+0x3cc/0x99c f2fsgc+0x190/0x750 f2fsbalancefs+0x110/0x168 f2fswritesingledatapage+0x474/0x7dc f2fswritedatapages+0x7d0/0xd0c dowritepages+0xe0/0x2f4 _writebacksingleinode+0x44/0x4ac writebacksbinodes+0x30c/0x538 wbwriteback+0xf4/0x440 wbworkfn+0x128/0x5d4 processscheduledworks+0x1c4/0x45c workerthread+0x32c/0x3e8 kthread+0x11c/0x1b0 retfromfork+0x10/0x20 Kernel panic - not syncing: kernel: paniconwarn set ...
[
{
"id": "CVE-2025-40196-0c1412bb",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f846eacde280ecc3daedfe001580e3033565179e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209011610890084824506637828921140738145",
"30670705407676988860044685752372830697",
"235138835133288427481761883760908756765",
"75997785982708685318752023222746752661",
"106483215331848294449676271809090522559",
"287074040246685766327384466453366148379",
"325239724501450349761023910328986556084",
"168422596927112019490773053412234716171",
"261392517591670895052080379637025764618",
"213177274859267032291719794525549902676"
]
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"id": "CVE-2025-40196-2d7a53aa",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f12039df1515d5daf7d92e586ece5cefeb39561b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209011610890084824506637828921140738145",
"30670705407676988860044685752372830697",
"235138835133288427481761883760908756765",
"75997785982708685318752023222746752661",
"106483215331848294449676271809090522559",
"287074040246685766327384466453366148379",
"325239724501450349761023910328986556084",
"262800234401547413260094038931996726538",
"68504579512597292050386427873421387767",
"141382027703947707527344245637266142121"
]
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"id": "CVE-2025-40196-2fe1dfd5",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f12039df1515d5daf7d92e586ece5cefeb39561b",
"signature_type": "Function",
"digest": {
"function_hash": "287289427447514084683322103838746941239",
"length": 816.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dqput"
}
},
{
"id": "CVE-2025-40196-34748d40",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f12039df1515d5daf7d92e586ece5cefeb39561b",
"signature_type": "Function",
"digest": {
"function_hash": "152363145089435532493007824643817738586",
"length": 1192.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_init"
}
},
{
"id": "CVE-2025-40196-3d492f48",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72b7ceca857f38a8ca7c5629feffc63769638974",
"signature_type": "Function",
"digest": {
"function_hash": "287289427447514084683322103838746941239",
"length": 816.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dqput"
}
},
{
"id": "CVE-2025-40196-5fa49d23",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72b7ceca857f38a8ca7c5629feffc63769638974",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209011610890084824506637828921140738145",
"30670705407676988860044685752372830697",
"235138835133288427481761883760908756765",
"75997785982708685318752023222746752661",
"106483215331848294449676271809090522559",
"287074040246685766327384466453366148379",
"325239724501450349761023910328986556084",
"262800234401547413260094038931996726538",
"68504579512597292050386427873421387767",
"141382027703947707527344245637266142121"
]
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"id": "CVE-2025-40196-7f90281b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a09a62f0c8c6123c2f1864ed6d5f9eb144afaf0",
"signature_type": "Function",
"digest": {
"function_hash": "287289427447514084683322103838746941239",
"length": 816.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dqput"
}
},
{
"id": "CVE-2025-40196-8212cbae",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f846eacde280ecc3daedfe001580e3033565179e",
"signature_type": "Function",
"digest": {
"function_hash": "282973138885846208944472346221329652532",
"length": 1135.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_init"
}
},
{
"id": "CVE-2025-40196-a09c141b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72b7ceca857f38a8ca7c5629feffc63769638974",
"signature_type": "Function",
"digest": {
"function_hash": "152363145089435532493007824643817738586",
"length": 1192.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_init"
}
},
{
"id": "CVE-2025-40196-ad2236b9",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a09a62f0c8c6123c2f1864ed6d5f9eb144afaf0",
"signature_type": "Function",
"digest": {
"function_hash": "152363145089435532493007824643817738586",
"length": 1192.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dquot_init"
}
},
{
"id": "CVE-2025-40196-da6eaeff",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a09a62f0c8c6123c2f1864ed6d5f9eb144afaf0",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209011610890084824506637828921140738145",
"30670705407676988860044685752372830697",
"235138835133288427481761883760908756765",
"75997785982708685318752023222746752661",
"106483215331848294449676271809090522559",
"287074040246685766327384466453366148379",
"325239724501450349761023910328986556084",
"262800234401547413260094038931996726538",
"68504579512597292050386427873421387767",
"141382027703947707527344245637266142121"
]
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c"
}
},
{
"id": "CVE-2025-40196-fe87d9e9",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f846eacde280ecc3daedfe001580e3033565179e",
"signature_type": "Function",
"digest": {
"function_hash": "23736685246007304775285639625263405327",
"length": 851.0
},
"deprecated": false,
"target": {
"file": "fs/quota/dquot.c",
"function": "dqput"
}
}
]