CVE-2026-89567

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89567", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.726Z", "datePublished": "2026-09-11T19:44:37.332Z", "dateUpdated": "2026-10-21T12:47:54.662Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:47:54.662Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: bound shrinker scans by examined checkpoint buffers\n\nThe jbd2 shrinker currently accounts only checkpoint buffers that it\nsuccessfully releases against nr_to_scan. Busy buffers therefore do not\nconsume the scan budget.\n\nIf a checkpoint transaction contains mostly busy buffers, the shrinker\ncan scan its entire checkpoint list while holding journal->j_list_lock.\nLarge checkpoint lists can result in excessive lock hold times and leave\nother CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.\n\nPass nr_to_scan into journal_shrink_one_cp_list() and decrement it for\nevery buffer examined, including busy buffers. Pass NULL from checkpoint\ncleanup paths so their existing full-list behavior is preserved.\n\nThis restores the scan-budget semantics that existed before\njournal_shrink_one_cp_list() was changed to always scan a complete\ncheckpoint list."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/jbd2/checkpoint.c"], "versions": [{"version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "lessThan": "6b5366ba63a58819396045ab146bd37ff9e503c6", "status": "affected", "versionType": "git"}, {"version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "lessThan": "edf5fcd0469b7467bd5b37a79502c8d9c3257dbb", "status": "affected", "versionType": "git"}, {"version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "lessThan": "71c6b872c746465fa4b5def239cb296173ca8216", "status": "affected", "versionType": "git"}, {"version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "lessThan": "c2c0fb364685b8996c357d3b050394959b29d6e0", "status": "affected", "versionType": "git"}, {"version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "lessThan": "15cb16496446b94e67f7abcb049b8e2c75cd3d02", "status": "affected", "versionType": "git"}, {"version": "9c31bb2684f8035beca0275349d19d679b679ffb", "status": "affected", "versionType": "git"}, {"version": "5fda50e262e65bd553ff777c4b280afd1495a18b", "status": "affected", "versionType": "git"}, {"version": "557fda9ed70ebf8eda2620ba3d746215285a1303", "status": "affected", "versionType": "git"}, {"version": "5.15.129", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.50", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.4.13", "lessThan": "6.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/jbd2/checkpoint.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.129"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6b5366ba63a58819396045ab146bd37ff9e503c6"}, {"url": "https://git.kernel.org/stable/c/edf5fcd0469b7467bd5b37a79502c8d9c3257dbb"}, {"url": "https://git.kernel.org/stable/c/71c6b872c746465fa4b5def239cb296173ca8216"}, {"url": "https://git.kernel.org/stable/c/c2c0fb364685b8996c357d3b050394959b29d6e0"}, {"url": "https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"}], "title": "jbd2: bound shrinker scans by examined checkpoint buffers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/jbd2/checkpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6b5366ba63a58819396045ab146bd37ff9e503c6", "status": "affected", "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "versionType": "git"}, {"lessThan": "edf5fcd0469b7467bd5b37a79502c8d9c3257dbb", "status": "affected", "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "versionType": "git"}, {"lessThan": "71c6b872c746465fa4b5def239cb296173ca8216", "status": "affected", "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "versionType": "git"}, {"lessThan": "c2c0fb364685b8996c357d3b050394959b29d6e0", "status": "affected", "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "versionType": "git"}, {"lessThan": "15cb16496446b94e67f7abcb049b8e2c75cd3d02", "status": "affected", "version": "b98dba273a0e47dbfade89c9af73c5b012a4eabb", "versionType": "git"}, {"status": "affected", "version": "9c31bb2684f8035beca0275349d19d679b679ffb", "versionType": "git"}, {"status": "affected", "version": "5fda50e262e65bd553ff777c4b280afd1495a18b", "versionType": "git"}, {"status": "affected", "version": "557fda9ed70ebf8eda2620ba3d746215285a1303", "versionType": "git"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.129", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.50", "versionType": "semver"}, {"lessThan": "6.5", "status": "affected", "version": "6.4.13", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/jbd2/checkpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: bound shrinker scans by examined checkpoint buffers\n\nThe jbd2 shrinker currently accounts only checkpoint buffers that it\nsuccessfully releases against nr_to_scan. Busy buffers therefore do not\nconsume the scan budget.\n\nIf a checkpoint transaction contains mostly busy buffers, the shrinker\ncan scan its entire checkpoint list while holding journal->j_list_lock.\nLarge checkpoint lists can result in excessive lock hold times and leave\nother CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.\n\nPass nr_to_scan into journal_shrink_one_cp_list() and decrement it for\nevery buffer examined, including busy buffers. Pass NULL from checkpoint\ncleanup paths so their existing full-list behavior is preserved.\n\nThis restores the scan-budget semantics that existed before\njournal_shrink_one_cp_list() was changed to always scan a complete\ncheckpoint list."}], "id": "CVE-2026-89567", "lastModified": "2026-10-21T13:20:09.000", "metrics": {}, "published": "2026-09-11T20:19:40.680", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b5366ba63a58819396045ab146bd37ff9e503c6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71c6b872c746465fa4b5def239cb296173ca8216"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c2c0fb364685b8996c357d3b050394959b29d6e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/edf5fcd0469b7467bd5b37a79502c8d9c3257dbb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: jbd2 shrinker can cause Denial of Service due to unbounded scans", "id": "2532120", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532120"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in the Linux kernel's jbd2 shrinker. This component, which manages journal buffers, does not correctly account for busy checkpoint buffers. This oversight can cause the shrinker to hold a critical system lock for an extended period when processing many busy buffers. The prolonged lock contention can lead to system unresponsiveness, such as soft lockups or RCU stalls, ultimately resulting in a Denial of Service (DoS)."], "name": "CVE-2026-89567", "public_date": "2026-09-11T19:44:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89567\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89567\nhttps://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02\nhttps://git.kernel.org/stable/c/71c6b872c746465fa4b5def239cb296173ca8216\nhttps://git.kernel.org/stable/c/c2c0fb364685b8996c357d3b050394959b29d6e0\nhttps://git.kernel.org/stable/c/edf5fcd0469b7467bd5b37a79502c8d9c3257dbb"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b98dba273a0e47dbfade89c9af73c5b012a4eabb,edf5fcd0469b7467bd5b37a79502c8d9c3257dbb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b98dba273a0e47dbfade89c9af73c5b012a4eabb,71c6b872c746465fa4b5def239cb296173ca8216)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b98dba273a0e47dbfade89c9af73c5b012a4eabb,c2c0fb364685b8996c357d3b050394959b29d6e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b98dba273a0e47dbfade89c9af73c5b012a4eabb,15cb16496446b94e67f7abcb049b8e2c75cd3d02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "9c31bb2684f8035beca0275349d19d679b679ffb"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5fda50e262e65bd553ff777c4b280afd1495a18b"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "557fda9ed70ebf8eda2620ba3d746215285a1303"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.129,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.50,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.4.13,6.5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T07:00:14.276872+00:00", "updated": "2026-09-15T22:30:15.255186+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}