{"id":"CVE-2026-89567","title":"jbd2: bound shrinker scans by examined checkpoint buffers","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\njbd2: bound shrinker scans by examined checkpoint buffers\n\nThe jbd2 shrinker currently accounts only checkpoint buffers that it\nsuccessfully releases against nr_to_scan…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-835"],"vendor":"Linux","product":"Linux","affected":["Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 6b5366ba63a58819396045ab146bd37ff9e503c6","Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < edf5fcd0469b7467bd5b37a79502c8d9c3257dbb","Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 71c6b872c746465fa4b5def239cb296173ca8216","Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < c2c0fb364685b8996c357d3b050394959b29d6e0","Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 15cb16496446b94e67f7abcb049b8e2c75cd3d02","Linux 9c31bb2684f8035beca0275349d19d679b679ffb","Linux 5fda50e262e65bd553ff777c4b280afd1495a18b","Linux 557fda9ed70ebf8eda2620ba3d746215285a1303","Linux >= 5.15.129 < 5.16","Linux >= 6.1.50 < 6.2","Linux >= 6.4.13 < 6.5","Linux 6.5"],"published":"2026-09-11","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:47:54.662Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89567","references":[{"url":"https://git.kernel.org/stable/c/6b5366ba63a58819396045ab146bd37ff9e503c6"},{"url":"https://git.kernel.org/stable/c/edf5fcd0469b7467bd5b37a79502c8d9c3257dbb"},{"url":"https://git.kernel.org/stable/c/71c6b872c746465fa4b5def239cb296173ca8216"},{"url":"https://git.kernel.org/stable/c/c2c0fb364685b8996c357d3b050394959b29d6e0"},{"url":"https://git.kernel.org/stable/c/15cb16496446b94e67f7abcb049b8e2c75cd3d02"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89567.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89567"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532120"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89567"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89567"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89567.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00206,"epssPercentile":0.10584,"ingestedAt":"2026-09-14T11:11:19.886Z","slug":"CVE-2026-89567","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\njbd2: bound shrinker scans by examined checkpoint buffers\n\nThe jbd2 shrinker currently accounts only checkpoint buffers that it\nsuccessfully releases against nr_to_scan.  Busy buffers therefore do not\nconsume the scan budget.\n\nIf a checkpoint transaction contains mostly busy buffers, the shrinker\ncan scan its entire checkpoint list while holding journal->j_list_lock.\nLarge checkpoint lists can result in excessive lock hold times and leave\nother CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.\n\nPass nr_to_scan into journal_shrink_one_cp_list() and decrement it for\nevery buffer examined, including busy buffers.  Pass NULL from checkpoint\ncleanup paths so their existing full-list behavior is preserved.\n\nThis restores the scan-budget semantics that existed before\njournal_shrink_one_cp_list() was changed to always scan a complete\ncheckpoint list.\n\n## Affected\n\n- `Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 6b5366ba63a58819396045ab146bd37ff9e503c6`\n- `Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < edf5fcd0469b7467bd5b37a79502c8d9c3257dbb`\n- `Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 71c6b872c746465fa4b5def239cb296173ca8216`\n- `Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < c2c0fb364685b8996c357d3b050394959b29d6e0`\n- `Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 15cb16496446b94e67f7abcb049b8e2c75cd3d02`\n- `Linux 9c31bb2684f8035beca0275349d19d679b679ffb`\n- `Linux 5fda50e262e65bd553ff777c4b280afd1495a18b`\n- `Linux 557fda9ed70ebf8eda2620ba3d746215285a1303`\n- `Linux >= 5.15.129 < 5.16`\n- `Linux >= 6.1.50 < 6.2`\n- `Linux >= 6.4.13 < 6.5`\n- `Linux 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89567.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":204101,"id":"CVE-2026-89567","ts":1789490231439,"field":"cvss","old":null,"new":"5.5"},{"seq":204100,"id":"CVE-2026-89567","ts":1789490231439,"field":"severity","old":"none","new":"medium"},{"seq":147708,"id":"CVE-2026-89567","ts":1789270211966,"field":"cvss","old":null,"new":"4.7"},{"seq":147707,"id":"CVE-2026-89567","ts":1789270211966,"field":"severity","old":"none","new":"medium"},{"seq":109466,"id":"CVE-2026-89567","ts":1789183732024,"field":"cvss","old":null,"new":"4.7"},{"seq":109465,"id":"CVE-2026-89567","ts":1789183732024,"field":"severity","old":"none","new":"medium"}]}