7

CVE-2025-23132: f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

Modified
AliasesUBUNTU-CVE-2025-23132DEBIAN-CVE-2025-23132CGA-2397-95qc-m384
Published 16-04-2025Last modified 21-10-2026

Vulnerability summary

CVE-2025-23132 is a high (CVSS 7.0) vulnerability in linux. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 32.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.0/10
010
High · v3.1 (CVE.org)
EPSS score
0.38%
0%100%
Low · +0.12 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 5
USN-7594-1USN-7594-2USN-7594-3USN-8781-1CGA-JWX4-FMM7-VM45

Timeline

  1. 16-04-2025
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix to avoid warning in dquot_writeback_dquots() F2FS-fs (dm-59): checkpoint=enable has some unwritten data. ------------[ cut here ]------------ WARNING: CPU: 6 PID: 8013 at fs/quota/dquot.c:691 dquot_writeback_dquots+0x2fc/0x308 pc : dquot_writeback_dquots+0x2fc/0x308 lr : f2fs_quota_sync+0xcc/0x1c4 Call trace: dquot_writeback_dquots+0x2fc/0x308 f2fs_quota_sync+0xcc/0x1c4 f2fs_write_checkpoint+0x3d4/0x9b0 f2fs_issue_checkpoint+0x1bc/0x2c0 f2fs_sync_fs+0x54/0x150 f2fs_do_sync_file+0x2f8/0x814 __f2fs_ioctl+0x1960/0x3244 f2fs_ioctl+0x54/0xe0 __arm64_sys_ioctl+0xa8/0xe4 invoke_syscall+0x58/0x114 checkpoint and f2fs_remount may race as below, resulting triggering warning in dquot_writeback_dquots(). atomic write remount - do_remount - down_write(&sb->s_umount); - f2fs_remount - ioctl - f2fs_do_sync_file - f2fs_sync_fs - f2fs_write_checkpoint - block_operations - locked = down_read_trylock(&sbi->sb->s_umount) : fail to lock due to the write lock was held by remount - up_write(&sb->s_umount); - f2fs_quota_sync - dquot_writeback_dquots - WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)) : trigger warning because s_umount lock was unlocked by remount If checkpoint comes from mount/umount/remount/freeze/quotactl, caller of checkpoint has already held s_umount lock, calling dquot_writeback_dquots() in the context should be safe. So let's record task to sbi->umount_lock_holder, so that checkpoint can know whether the lock has held in the context or not by checking current w/ it. In addition, in order to not misrepresent caller of checkpoint, we should not allow to trigger async checkpoint for those callers: mount/umount/remount/ freeze/quotactl.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

Increase +0.12 pp

From 0.26% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu141 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Chainguard5 products
  • linux-aws-6.12< 6.12.63-r0 | < 6.12.60-r4 | < 6.12.62-r2 | < 6.12.65-r0 | < 6.12.77-r0 | < 6.12.70-r0 | < 6.12.65-r2 | < 6.12.66-r0 | < 6.12.72-r0 | < 6.12.62-r1 | < 6.12.67-r0 | < 6.12.71-r0 | < 6.12.78-r0 | < 6.12.74-r1 | < 6.12.72-r1 | < 6.12.62-r0 | < 6.12.74-r0 | < 6.12.69-r0 | < 6.12.77-r1 | < 6.12.65-r1 | < 6.12.76-r0 | < 6.12.80-r0 | < 6.12.57-r1 | < 6.12.57-r2 | < 6.12.77-r2 | < 6.12.68-r0 | < 6.12.68-r1
  • linux-azure-6.12< 6.12.67-r0 | < 6.12.74-r1 | < 6.12.62-r0 | < 6.12.65-r2 | < 6.12.60-r4 | < 6.12.70-r0 | < 6.12.60-r3 | < 6.12.66-r0 | < 6.12.77-r0 | < 6.12.78-r0 | < 6.12.68-r0 | < 6.12.71-r0 | < 6.12.62-r2 | < 6.12.65-r4 | < 6.12.65-r3 | < 6.12.62-r1 | < 6.12.65-r1 | < 6.12.72-r0 | < 6.12.57-r1 | < 6.12.80-r0 | < 6.12.77-r1 | < 6.12.77-r2 | < 6.12.69-r0 | < 6.12.76-r0 | < 6.12.63-r0 | < 6.12.74-r0 | < 6.12.57-r2
  • linux-gcp-6.12< 6.12.70-r0 | < 6.12.67-r0 | < 6.12.77-r2 | < 6.12.65-r0 | < 6.12.74-r1 | < 6.12.60-r4 | < 6.12.77-r0 | < 6.12.57-r2 | < 6.12.76-r0 | < 6.12.78-r0 | < 6.12.68-r0 | < 6.12.71-r0 | < 6.12.72-r0 | < 6.12.62-r1 | < 6.12.62-r0 | < 6.12.69-r0 | < 6.12.63-r0 | < 6.12.62-r2 | < 6.12.68-r1 | < 6.12.77-r1 | < 6.12.66-r0 | < 6.12.80-r0 | < 6.12.65-r1 | < 6.12.57-r1 | < 6.12.74-r0 | < 6.12.65-r2 | < 6.12.60-r3
  • linux-qemu-6.12< 6.12.71-r0 | < 6.12.70-r0 | < 6.12.74-r0 | < 6.12.77-r2 | < 6.12.77-r1 | < 6.12.78-r0 | < 6.12.66-r0 | < 6.12.76-r0 | < 6.12.68-r0 | < 6.12.72-r0 | < 6.12.67-r0 | < 6.12.74-r1 | < 6.12.65-r1 | < 6.12.69-r0 | < 6.12.65-r2 | < 6.12.77-r0 | < 6.12.80-r0
  • linux-vmware-6.12< 6.12.68-r0 | < 6.12.74-r0 | < 6.12.68-r1 | < 6.12.72-r0 | < 6.12.76-r0 | < 6.12.77-r2 | < 6.12.69-r0 | < 6.12.71-r0 | < 6.12.66-r0 | < 6.12.67-r0 | < 6.12.65-r2 | < 6.12.65-r1 | < 6.12.77-r1 | < 6.12.74-r1 | < 6.12.77-r0 | < 6.12.70-r0 | < 6.12.80-r0 | < 6.12.78-r0
Linux2 products
  • linux≥ af033b2aa8a874fd5737fafe90d159136527b5b4, < 9ec535db9da76dafa05c89f8b58a0b1d7dddba1c | ≥ af033b2aa8a874fd5737fafe90d159136527b5b4, < d7acf0a6c87aa282c86a36dbaa2f92fda88c5884 | ≥ af033b2aa8a874fd5737fafe90d159136527b5b4, < eb85c2410d6f581e957cd03a644ff6ddbe592af9 | 4.20
  • linux_kernel≥ 4.20, < 6.14.2
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.115-2 | < 6.16.3-1

4 vendors · 149 products

References

14 links
Show all 14 references