CVE-2025-40196

A workqueue configuration mismatch was found in the Linux kernel's filesystem quota subsystem during writeback operations. A local user can trigger this issue when f2fs filesystem balancing initiates quota writeback during sync operations, causing the writeback workqueue to flush quota_release_work from the events_unbound queue. Since events_unbound lacks the WQ_MEM_RECLAIM flag while the writeback queue has it, this flag mismatch triggers workqueue dependency warnings and causes kernel panic when panic_on_warn is enabled, resulting in denial of service.

Quota release work is queued to events_unbound (no WQ_MEM_RECLAIM flag) but gets flushed during f2fs writeback from a WQ_MEM_RECLAIM context. This flag mismatch triggers workqueue dependency checks that warn about potential deadlocks—if memory reclaim needs the work to complete but the work needs memory, deadlock could occur. Systems with panic_on_warn turn this warning into a hard panic. The fix creates a dedicated quota workqueue with the proper WQ_MEM_RECLAIM flag.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.