Executive brief
The Linux kernel's jbd2 (journaling block device 2) subsystem used for filesystem journaling contains a flaw in checkpoint buffer processing. Under memory pressure with large lists of busy buffers, the kernel can hold a critical lock for extended periods without checking if other CPUs need scheduling, causing system stalls and potential service unavailability.
Technical details
The vulnerability is a logic error in journal_shrink_one_cp_list() in fs/jbd2/checkpoint.c. When skipping busy checkpoint buffers (with JBD2_SHRINK_BUSY_SKIP flag), a continue statement bypasses the need_resched() check at the end of the loop, allowing the shrinker to traverse large checkpoint lists while holding journal->j_list_lock. This causes prolonged lock contention, spinning on other CPUs, and soft lockups or RCU stalls. The fix routes the busy-buffer skip path through the need_resched() check via a goto statement, ensuring the lock can be released and the CPU can reschedule. No memory corruption or privilege escalation is possible; the issue is purely a denial-of-service condition affecting system responsiveness under memory pressure.
Affected products
- Linux Linux kernel Linux 3.x through 7.x (all versions affected, fix backported to stable branches)
Timeline
- 2026-07-13: disclosed: Patch authored by Max Kellermann
- 2026-07-22: patched: Fix merged to upstream kernel
- 2026-09-07: patched: Fix backported to stable kernel branches
- 2026-09-11: advisory: CVE-2026-89566 published