CVE-2026-89567 jbd2: bound shrinker scans by examined checkpoint buffers
A flaw in the Linux kernel jbd2 shrinker allows local attackers to cause soft lockups or RCU stalls by triggering excessive lock hold times during checkpoint buffer scans.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89567?
CVE-2026-89567 is a denial of service vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jbd2: bound shrinker scans by examined checkpoint buffers
The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget.
If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.
Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved.
This restores the scan-budget semantics that existed before journal_shrink_one_cp_list() was changed to always scan a complete checkpoint list.
Which versions are affected by CVE-2026-89567?
How do I fix CVE-2026-89567?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-89567 being exploited?
There is no known exploitation of CVE-2026-89567 in the wild and no public exploit code.
Sources
Also known as AZL-100253, BELL-CVE-2026-89567, DEBIAN-CVE-2026-89567, GHSA-297x-6x5c-99gq, UBUNTU-CVE-2026-89567.