CVE-2025-40196

Source
https://cve.org/CVERecord?id=CVE-2025-40196
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40196.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-40196
Downstream
Related
Published
2025-11-12T21:56:32.578Z
Modified
2026-03-20T12:43:12.856968Z
Summary
fs: quota: create dedicated workqueue for quota_release_work
Details

In the Linux kernel, the following vulnerability has been resolved:

fs: quota: create dedicated workqueue for quotareleasework

There is a kernel panic due to WARNONCE when panicon_warn is set.

This issue occurs when writeback is triggered due to sync call for an opened file(ie, writeback reason is WBREASONSYNC). When f2fs balance is needed at sync path, flush for quotareleasework is triggered. By default quotareleasework is queued to "eventsunbound" queue which does not have WQMEMRECLAIM flag. During f2fs balance "writeback" workqueue tries to flush quotareleasework causing kernel panic due to MEMRECLAIM flag mismatch errors.

This patch creates dedicated workqueue with WQMEMRECLAIM flag for work quotareleasework.

------------[ cut here ]------------ WARNING: CPU: 4 PID: 14867 at kernel/workqueue.c:3721 checkflushdependency+0x13c/0x148 Call trace: checkflushdependency+0x13c/0x148 __flushwork+0xd0/0x398 flushdelayed_work+0x44/0x5c dquotwritebackdquots+0x54/0x318 f2fsdoquotasync+0xb8/0x1a8 f2fswritecheckpoint+0x3cc/0x99c f2fsgc+0x190/0x750 f2fsbalancefs+0x110/0x168 f2fswritesingledatapage+0x474/0x7dc f2fswritedatapages+0x7d0/0xd0c dowritepages+0xe0/0x2f4 _writebacksingleinode+0x44/0x4ac writebacksbinodes+0x30c/0x538 wbwriteback+0xf4/0x440 wbworkfn+0x128/0x5d4 processscheduledworks+0x1c4/0x45c workerthread+0x32c/0x3e8 kthread+0x11c/0x1b0 retfromfork+0x10/0x20 Kernel panic - not syncing: kernel: paniconwarn set ...

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40196.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bcacb52a985f1b6d280f698a470b873dfe52728a
Fixed
f846eacde280ecc3daedfe001580e3033565179e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8ea87e34792258825d290f4dc5216276e91cb224
Fixed
f12039df1515d5daf7d92e586ece5cefeb39561b
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ac6f420291b3fee1113f21d612fa88b628afab5b
Fixed
8a09a62f0c8c6123c2f1864ed6d5f9eb144afaf0
Fixed
72b7ceca857f38a8ca7c5629feffc63769638974
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a5abba5e0e586e258ded3e798fe5f69c66fec198
Last affected
6f3821acd7c3143145999248087de5fb4b48cf26
Last affected
ab6cfcf8ed2c7496f55d020b65b1d8cd55d9a2cb
Last affected
3e6ff207cd5bd924ad94cd1a7c633bcdac0ba1cb

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40196.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.6.114
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.54
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.17.4

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40196.json"