CVE-2025-40196

The vulnerability is a kernel panic triggered in the Linux kernel's quota subsystem when panic_on_warn is enabled. The root cause is that quota_release_work was queued to the global events_unbound workqueue, which lacks the WQ_MEM_RECLAIM flag. When a flush operation is attempted from a context that expects reclaim-safe workqueues, a WARN_ON in check_flush_dependency fires, leading to a kernel panic if panic_on_warn is set.

The issue is exploited via a specific I/O path. When writeback is initiated by a sync call (writeback reason WB_REASON_SYNC), and f2fs (a flash-friendly file system) triggers a balance operation, a quota sync is performed. This calls dquot_writeback_dquots, which tries to flush quota_release_work. Because the work was scheduled on events_unbound without WQ_MEM_RECLAIM, and the flushing context (f2fs writeback) is itself a reclaim path, the kernel detects a dependency violation and issues a warning.

The impact is severe: on systems with panic_on_warn enabled (common in production for reliability), the warning causes an immediate kernel panic, resulting in denial of service. Even without panic_on_warn, the warning may indicate potential deadlocks or system instability. The vulnerability affects all kernels using the quota subsystem with f2fs, particularly during synchronous writeback scenarios.

The fix involves creating a dedicated workqueue quota_release_wq with the WQ_MEM_RECLAIM flag, ensuring that flushing from reclaim contexts is safe. The patches have been applied to the Linux kernel stable branches as commits [1] and [2]. Users should apply the latest stable kernel updates to mitigate this issue.