Cloudanix VulnDB

CVE-2025-23132

None

CVSS

—

EPSS

0.4%

Published

Apr 16, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A timing problem in the Linux filesystem can cause warning messages when administrators change settings while files are being synchronized.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between F2FS checkpoint and remount operations allows dquot_writeback_dquots to execute without the s_umount rwsem held, triggering a kernel WARNING.

Why it matters to the business

Filesystem operations on F2FS volumes with quotas may produce kernel warnings and operational noise during mount, remount, or sync activities, raising support costs on affected systems.

How an attack unfolds

A local process triggers an ioctl-based sync while a concurrent remount holds the write side of s_umount; the checkpoint path then fails the lock check inside dquot_writeback_dquots.

How to fix it

Upgrade affected packages to the listed fixed versions (e.g., ruby 0:2.5.9-108.module+el8.4.0+22645+8a608fad and corresponding module packages) and reboot if a new kernel is supplied; avoid async checkpoints from mount/remount paths until patched.

How to confirm the fix worked

After update, confirm absence of the dquot_writeback_dquots WARNING during concurrent remount and checkpoint workloads; verify package versions match the supplied fixed module releases.

Typical attack path

  1. Obtain local shell on system with F2FS quota-enabled volume
  2. Issue f2fs ioctl sync while remount is in progress
  3. Observe kernel warning in dmesg or logs

How to detect it

Search kernel logs for the exact WARNING line containing dquot_writeback_dquots+0x2fc and f2fs_quota_sync call stack; correlate with remount or checkpoint events in audit logs.

  • WARNING: CPU.*dquot_writeback_dquots+0x2fc/0x308
  • f2fs_quota_sync+0xcc/0x1c4
  • f2fs_write_checkpoint.*block_operations
  • WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount))

What your security team should do

  • Apply the listed fixed package versions immediately on all F2FS systems
  • Monitor dmesg for the specific WARNING string until patches are deployed
  • Restrict unprivileged use of F2FS ioctls where possible

The record

In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() F2FS-fs (dm-59): checkpoint=enable has some unwritten data. ------------[ cut here ]------------ WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308 pc : dquot_writeback_dquots+0x2fc/0x308 lr : f2fs_quota_sync+0xcc/0x1c4 Call trace: dquot_writeback_dquots+0x2fc/0x308 f2fs_quota_sync+0xcc/0x1c4 f2fs_write_checkpoint+0x3d4/0x9b0 f2fs_issue_checkpoint+0x1bc/0x2c0 f2fs_sync_fs+0x54/0x150 f2fs_do_sync_file+0x2f8/0x814 __f2fs_ioctl+0x1960/0x3244 f2fs_ioctl+0x54/0xe0 __arm64_sys_ioctl+0xa8/0xe4 invoke_syscall+0x58/0x114 checkpoint and f2fs_remount may race as below, resulting triggering warning in dquot_writeback_dquots(). atomic write remount - do_remount - down_write(&sb->s_umount); - f2fs_remount - ioctl - f2fs_do_sync_file - f2fs_sync_fs - f2fs_write_checkpoint - block_operations - locked = down_read_trylock(&sbi->sb->s_umount) : fail to lock due to the write lock was held by remount - up_write(&sb->s_umount); - f2fs_quota_sync - dquot_writeback_dquots - WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)) : trigger warning because s_umount lock was unlocked by remount If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of checkpoint has already held s_umount lock, calling dquot_writeback_dquots() in the context should be safe. So let's record task to sbi->umount_lock_holder, so that checkpoint can know whether the lock has held in the context or not by checking current w/ it. In addition, in order to not misrepresent caller of checkpoint, we should not allow to trigger async checkpoint for those callers: mount/umount/remount/ freeze/quotactl.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard hyperv-daemons-6.12 0 6.12.57-r0
Chainguard linux-aws-6.12-boot-installed 0 6.12.57-r0
Chainguard linux-aws-6.12-fips-boot-installed 0 6.12.57-r0
Chainguard linux-aws-6.12-headers 0 6.12.57-r1
Chainguard linux-aws-6.12-modules 0 6.12.57-r0
Chainguard linux-azure-6.12-boot-installed 0 6.12.57-r0
Chainguard linux-azure-6.12-fips-boot-installed 0 6.12.57-r0
Chainguard linux-azure-6.12-headers 0 6.12.57-r1
Chainguard linux-azure-6.12-modules 0 6.12.57-r0
Chainguard linux-gcp-6.12-boot-installed 0 6.12.57-r0
Chainguard linux-gcp-6.12-fips-boot-installed 0 6.12.57-r0
Chainguard linux-gcp-6.12-headers 0 6.12.57-r1
Chainguard linux-gcp-6.12-modules 0 6.12.57-r1
Chainguard linux-qemu-6.12-boot-installed 0 6.12.63-r0
Chainguard linux-qemu-6.12-fips-boot-installed 0 6.12.63-r0
Chainguard linux-qemu-6.12-headers 0 6.12.63-r0
Chainguard linux-qemu-6.12-modules 0 6.12.63-r0
Chainguard linux-vmware-6.12-boot-installed 0 6.12.63-r0
Chainguard linux-vmware-6.12-fips-boot-installed 0 6.12.63-r0
Chainguard linux-vmware-6.12-headers 0 6.12.63-r0
Chainguard linux-vmware-6.12-modules 0 6.12.63-r0
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 No fix
Debian:14 linux 0 6.16.3-1
Linux Kernel 4.20.0 6.14.2

Related vulnerabilities