CVE-2026-89567

jbd2: bound shrinker scans by examined checkpoint buffers

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 21, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

jbd2: bound shrinker scans by examined checkpoint buffers

The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget.

If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.

Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved.

This restores the scan-budget semantics that existed before journal_shrink_one_cp_list() was changed to always scan a complete checkpoint list.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b98dba273a0e47dbfade89c9af73c5b012a4eabb to before 6b5366ba63a58819396045ab146bd37ff9e503c6Affected b98dba273a0e47dbfade89c9af73c5b012a4eabb to before edf5fcd0469b7467bd5b37a79502c8d9c3257dbbAffected b98dba273a0e47dbfade89c9af73c5b012a4eabb to before 71c6b872c746465fa4b5def239cb296173ca8216Affected b98dba273a0e47dbfade89c9af73c5b012a4eabb to before c2c0fb364685b8996c357d3b050394959b29d6e0Affected b98dba273a0e47dbfade89c9af73c5b012a4eabb to before 15cb16496446b94e67f7abcb049b8e2c75cd3d02Affected 9c31bb2684f8035beca0275349d19d679b679ffbAffected 5fda50e262e65bd553ff777c4b280afd1495a18bAffected 557fda9ed70ebf8eda2620ba3d746215285a1303Affected 5.15.129 to before 5.16Affected 6.1.50 to before 6.2Affected 6.4.13 to before 6.5Affected
LinuxLinux	6.5Affected before 6.5Not affected 6.6.160 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b98dba273a0e47dbfade89c9af73c5b012a4eabb to before 6b5366ba63a58819396045ab146bd37ff9e503c6Affected
b98dba273a0e47dbfade89c9af73c5b012a4eabb to before edf5fcd0469b7467bd5b37a79502c8d9c3257dbbAffected
b98dba273a0e47dbfade89c9af73c5b012a4eabb to before 71c6b872c746465fa4b5def239cb296173ca8216Affected
b98dba273a0e47dbfade89c9af73c5b012a4eabb to before c2c0fb364685b8996c357d3b050394959b29d6e0Affected
b98dba273a0e47dbfade89c9af73c5b012a4eabb to before 15cb16496446b94e67f7abcb049b8e2c75cd3d02Affected
9c31bb2684f8035beca0275349d19d679b679ffbAffected
5fda50e262e65bd553ff777c4b280afd1495a18bAffected
557fda9ed70ebf8eda2620ba3d746215285a1303Affected
5.15.129 to before 5.16Affected
6.1.50 to before 6.2Affected
6.4.13 to before 6.5Affected

LinuxLinux

6.5Affected
before 6.5Not affected
6.6.160 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.