CVE-2026-89566 jbd2: check need_resched() when skipping busy checkpoint buffers
A flaw in the Linux kernel's jbd2 journaling code can cause soft lockups or RCU stalls under memory pressure, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89566?
CVE-2026-89566 is a denial of service vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jbd2: check need_resched() when skipping busy checkpoint buffers
journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body.
Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls.
Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal.
Which versions are affected by CVE-2026-89566?
How do I fix CVE-2026-89566?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89566 being exploited?
There is no known exploitation of CVE-2026-89566 in the wild and no public exploit code.
Sources
Also known as AZL-100688, BELL-CVE-2026-89566, DEBIAN-CVE-2026-89566, GHSA-p6jx-2fv3-6j26, UBUNTU-CVE-2026-89566.