The flaw lies in the GFS2 filesystem’s quota initialization routine where a duplicate quota_change check is performed while holding a hash bucket bitlock. Under a PREEMPT-RT kernel the routine may invoke a lockref function that is allowed to sleep, which is prohibited while the bitlock is held. This mismatch triggers a "sleeping function called from invalid context" fault that can cause a kernel panic. The defect, an instance of CWE-821, was discovered by fuzzing and was corrected by replacing the lockref lookup with a no‑reference bucket search, removing the prohibited sleep path. Based on the description, the likely attack vector is a local privileged user or a compromised root process that initiates GFS2 quota initialization under a PREEMPT-RT configuration.

All Linux kernel releases that include the legacy GFS2 quota initialization path and are built with PREEMPT-RT enabled are affected. Any system that mounts a GFS2 filesystem with quota support before the patch is applied will be vulnerable. Distinguishing the exact version range is not provided, so any kernel containing the vulnerable logic should be considered at risk.

Based on the description, the likely attack vector is a local privileged user or compromised root process that initiates GFS2 quota initialization on a PREEMPT-RT enabled kernel. Because the vulnerability requires a preemptible real‑time kernel configuration and GFS2 quota support, the attack surface is confined to privileged local users or compromised root processes. An attacker can force a kernel panic, creating a denial‑of‑service scenario, but the flaw does not enable remote code execution or data exposure. No public exploit exists, the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 5.5 reflects moderate risk. The overall risk is moderate for environments that run GFS2 with quotas on PREEMPT-RT kernels, while standard kernels without PREEMPT-RT are unaffected.