Cloudanix VulnDB

CVE-2026-89566

None

CVSS

—

EPSS

0.2%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can make the system freeze or crash when the computer runs low on memory and has to clean up its journal lists.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The journal shrinker path that skips busy checkpoint buffers bypasses the need_resched() test, allowing journal->j_list_lock to be held across an entire large checkpoint list and producing soft lockups or RCU stalls on other CPUs.

Why it matters to the business

Under memory pressure, Linux systems can experience prolonged lock contention that stalls kernel threads, degrades responsiveness, or triggers watchdog resets, increasing operational risk for workloads that rely on journaling filesystems.

How an attack unfolds

An attacker or automated workload creates memory pressure that forces repeated calls to the busy-skip shrinker path; because the resched check is omitted, the lock is held long enough to starve other CPUs and produce observable stalls without any code execution or privilege escalation required.

How to fix it

Apply the upstream fix that routes the busy-buffer continue path through the existing need_resched() check; rebuild and boot the corrected kernel. Monitor for newer stable releases that contain the patch.

How to confirm the fix worked

Confirm the presence of the need_resched() test on the JBD2_SHRINK_BUSY_SKIP continue path in journal_shrink_one_cp_list(); run memory-pressure workloads that generate large checkpoint lists and verify absence of soft lockup or RCU stall warnings.

Typical attack path

  1. Trigger memory-reclaim activity that invokes the jbd2 shrinker
  2. Ensure the checkpoint list contains a high proportion of busy buffers
  3. Walk the list while holding j_list_lock without yielding
  4. Induce soft lockup or RCU stall on contending CPUs

How to detect it

Search kernel logs for soft lockup, RCU stall, or watchdog messages that mention j_list_lock or journal_shrink_one_cp_list; correlate with periods of high memory pressure and large checkpoint lists.

What your security team should do

  • Prioritize kernel updates on systems that mount journaling filesystems under memory pressure
  • Add kernel soft-lockup and RCU stall counters to existing monitoring
  • Test the fix under synthetic memory-reclaim workloads before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal.

Affected packages

Ecosystem Package Introduced Fixed