CVE-2026-89567Medium· 5.5▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
— → 4.7
none → medium
— → 4.7
none → medium
— → 5.5
none → medium
0.2% → 0.2%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
jbd2: bound shrinker scans by examined checkpoint buffers
The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget.
If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j_list_lock, causing soft lockups or RCU stalls.
Pass nr_to_scan into journal_shrink_one_cp_list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved.
This restores the scan-budget semantics that existed before journal_shrink_one_cp_list() was changed to always scan a complete checkpoint list.
Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 6b5366ba63a58819396045ab146bd37ff9e503c6Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < edf5fcd0469b7467bd5b37a79502c8d9c3257dbbLinux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 71c6b872c746465fa4b5def239cb296173ca8216Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < c2c0fb364685b8996c357d3b050394959b29d6e0Linux >= b98dba273a0e47dbfade89c9af73c5b012a4eabb < 15cb16496446b94e67f7abcb049b8e2c75cd3d02Linux 9c31bb2684f8035beca0275349d19d679b679ffbLinux 5fda50e262e65bd553ff777c4b280afd1495a18bLinux 557fda9ed70ebf8eda2620ba3d746215285a1303Linux >= 5.15.129 < 5.16Linux >= 6.1.50 < 6.2Linux >= 6.4.13 < 6.5Linux 6.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100070Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shor…
CVE-2026-100071Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before t…
CVE-2025-39977High· 7.8In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() fute…
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance