FKIE_CVE-2026-89566

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-11 20:19
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/595cac7f1b32d009b97f83dd2b2d6a1a445e9bb4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f83c23286e54180cdc83a36463a60003534cc290
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f9182a85991a0ad5cd2940df6db75f40ad90028c
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/jbd2/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f83c23286e54180cdc83a36463a60003534cc290",
              "status": "affected",
              "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb",
              "versionType": "git"
            },
            {
              "lessThan": "f9182a85991a0ad5cd2940df6db75f40ad90028c",
              "status": "affected",
              "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb",
              "versionType": "git"
            },
            {
              "lessThan": "595cac7f1b32d009b97f83dd2b2d6a1a445e9bb4",
              "status": "affected",
              "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb",
              "versionType": "git"
            },
            {
              "lessThan": "f213e12ff5c9590b1034ae8da0e6d09665c772d0",
              "status": "affected",
              "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c31bb2684f8035beca0275349d19d679b679ffb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5fda50e262e65bd553ff777c4b280afd1495a18b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "557fda9ed70ebf8eda2620ba3d746215285a1303",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.129",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.50",
              "versionType": "semver"
            },
            {
              "lessThan": "6.5",
              "status": "affected",
              "version": "6.4.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/jbd2/checkpoint.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: check need_resched() when skipping busy checkpoint buffers\n\njournal_shrink_one_cp_list() skips busy checkpoint buffers when called\nwith JBD2_SHRINK_BUSY_SKIP.  The continue statement on this path also\nskips the need_resched() check at the end of the loop body.\n\nConsequently, when a checkpoint list contains mostly busy buffers, the\nshrinker can walk the entire list while holding journal-\u003ej_list_lock,\neven when a reschedule has been requested.  Large checkpoint lists under\nmemory pressure can therefore cause long lock hold times and leave other\nCPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls.\n\nRoute the busy-buffer path through the need_resched() check so that the\nshrinker can release j_list_lock and reschedule promptly, restoring\nparity with the clean-buffer path, which already checks need_resched().\nThis does not change which checkpoint buffers are eligible for removal."
    }
  ],
  "id": "CVE-2026-89566",
  "lastModified": "2026-09-11T20:19:40.550",
  "metrics": {},
  "published": "2026-09-11T20:19:40.550",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/595cac7f1b32d009b97f83dd2b2d6a1a445e9bb4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f83c23286e54180cdc83a36463a60003534cc290"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f9182a85991a0ad5cd2940df6db75f40ad90028c"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.