CVE-2026-89567

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

jbd2: bound shrinker scans by examined checkpoint buffers

The jbd2 shrinker currently accounts only checkpoint buffers that it

successfully releases against nr_to_scan. Busy buffers therefore do not

consume the scan budget.

If a checkpoint transaction contains mostly busy buffers, the shrinker

can scan its entire checkpoint list while holding journal->j_list_lock.

Large checkpoint lists can result in excessive lock hold times and leave

other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.

Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for

every buffer examined, including busy buffers. Pass NULL from checkpoint

cleanup paths so their existing full-list behavior is preserved.

This restores the scan-budget semantics that existed before

journal_shrink_one_cp_list() was changed to always scan a complete

checkpoint list.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References