Executive brief
The Linux kernel's jbd2 journal subsystem uses a memory shrinker to manage checkpoint buffers, but a bug in the shrinker's scan accounting allowed it to hold the journal list lock for excessive periods. When processing transactions with many busy buffers, the lock could be held while scanning entire checkpoint lists, causing other CPUs to stall and triggering soft lockup warnings. This denial-of-service condition affects systems using jbd2 (the default journal for ext4 filesystems) under high I/O load.
Technical details
The vulnerability is a logic error in the jbd2 checkpoint shrinker's scan-budget accounting. The shrinker was counting only successfully-released buffers against its nr_to_scan budget, meaning busy (locked) buffers did not consume scan quota. When a checkpoint transaction contained mostly busy buffers, the shrinker would scan the entire checkpoint list while holding journal->j_list_lock, causing excessive lock contention. The fix passes nr_to_scan into journal_shrink_one_cp_list() and decrements it for every buffer examined (busy or released), restoring proper scan-budget semantics. The vulnerability affects all Linux kernels with the affected jbd2 code path and is fixed by commit 15cb16496446b94e67f7abcb049b8e2c75cd3d02.
Affected products
- Linux Linux kernel multiple versions (jbd2 checkpoint shrinker affected versions)
Timeline
- 2026-09-11: disclosed
- 2026-07-22: patched: commit 15cb16496446b94e67f7abcb049b8e2c75cd3d02 by Theodore Ts'o