CVE-2026-89759

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/kmemleak: avoid soft lockup when scanning task stacks

Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3.

kmemleak_scan() scans every task stack under one rcu_read_lock() with no

reschedule point, which can trip the soft lockup watchdog on hosts with

very many threads.

That prints the following message, depending on the workload+host

configuration:

watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537]

scan_block

kmemleak_scan

kmemleak_scan_thread

kthread

Patch 1 walks the tasks with find_ge_pid() so the scan reschedules between

tasks

Patches 2-3 let the scan loops stop early once a scan is interrupted.

This patch (of 3):

kmemleak_scan() walks every thread and scans its kernel stack under a

single rcu_read_lock() with no reschedule point. On a host with very many

threads -- amplified by KASAN/lockdep in debug builds -- this loop can hog

a CPU

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References