{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89566 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89566 is a denial of service vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89566 and fix it if it is affected.\n\nWhat it is: CVE-2026-89566 is a denial of service vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89566 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89566/ (Markdown: https://insights.sbomify.com/CVE-2026-89566/index.md)","id":"CVE-2026-89566","markdown":"https://insights.sbomify.com/CVE-2026-89566/index.md","name":"CVE-2026-89566","record":{"aliases":["AZL-100688","BELL-CVE-2026-89566","DEBIAN-CVE-2026-89566","GHSA-p6jx-2fv3-6j26","UBUNTU-CVE-2026-89566"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A flaw in the Linux kernel's jbd2 journaling code can cause soft lockups or RCU stalls under memory pressure, leading to denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: check need_resched() when skipping busy checkpoint buffers\n\njournal_shrink_one_cp_list() skips busy checkpoint buffers when called\nwith JBD2_SHRINK_BUSY_SKIP.  The continue statement on this path also\nskips the need_resched() check at the end of the loop body.\n\nConsequently, when a checkpoint list contains mostly busy buffers, the\nshrinker can walk the entire list while holding journal-\u003ej_list_lock,\neven when a reschedule has been requested.  Large checkpoint lists under\nmemory pressure can therefore cause long lock hold times and leave other\nCPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls.\n\nRoute the busy-buffer path through the need_resched() check so that the\nshrinker can release j_list_lock and reschedule promptly, restoring\nparity with the clean-buffer path, which already checks need_resched().\nThis does not change which checkpoint buffers are eligible for removal.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"jbd2: check need_resched() when skipping busy checkpoint buffers","id":"CVE-2026-89566","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"jbd2: bound shrinker scans by examined checkpoint buffers","id":"CVE-2026-89567"},"packages":[],"prev":{"headline":"ipip: fix skb leak in collect_md mode when metadata_dst allocation fails","id":"CVE-2026-89565"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A flaw in the Linux kernel's jbd2 journaling code can cause soft lockups or RCU stalls under memory pressure, leading to denial of service.","url":"https://insights.sbomify.com/CVE-2026-89566/"}