CVE-2026-89567: Linux Kernel JBD2 DOS Vulnerability

CVE-2026-89567 Overview

CVE-2026-89567 is a Linux kernel vulnerability in the jbd2 journaling layer used by the ext4 filesystem. The jbd2 shrinker accounts only checkpoint buffers it successfully releases against nr_to_scan, allowing busy buffers to bypass the scan budget. When a checkpoint transaction contains mostly busy buffers, the shrinker can traverse the entire checkpoint list while holding journal->j_list_lock. Large checkpoint lists produce excessive lock hold times, causing other CPUs to spin on j_list_lock and triggering soft lockups or RCU stalls. The upstream fix bounds shrinker scans by counting every buffer examined, including busy ones.

Critical Impact
The flaw enables kernel-level denial of service through soft lockups and RCU stalls on systems with large ext4 checkpoint lists under memory pressure.

Affected Products

Linux kernel versions containing the modified journal_shrink_one_cp_list() implementation
Distributions shipping ext4/jbd2 from affected upstream ranges
Server and workstation deployments using ext4 filesystems under sustained memory pressure

Discovery Timeline

2026-09-11 - CVE-2026-89567 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89567

Vulnerability Analysis

The jbd2 (Journaling Block Device 2) subsystem manages the ext4 write-ahead journal. It registers a shrinker with the memory management subsystem to release checkpointed buffers under memory pressure. The shrinker walks checkpoint transaction lists and attempts to free buffers no longer required for filesystem consistency.

The defect resides in journal_shrink_one_cp_list(). Only buffers that the shrinker successfully releases are subtracted from nr_to_scan. Buffers that remain busy — pinned by concurrent I/O, writeback, or transaction commit — do not decrement the scan budget. Under adverse conditions, the loop iterates over the entire checkpoint list without ever exhausting nr_to_scan, all while holding journal->j_list_lock.

Root Cause

The root cause is a scan-budget accounting error introduced when journal_shrink_one_cp_list() was modified to always traverse a complete checkpoint list. The function did not track buffers merely examined, so busy buffers were invisible to the throttling logic. This is a resource exhaustion condition amplified by lock contention on j_list_lock.

Attack Vector

A local workload that generates large checkpoint lists with many busy buffers — for example, sustained metadata-heavy ext4 activity combined with memory pressure — can trigger prolonged shrinker execution. Other CPUs contending for j_list_lock stall, producing kernel soft lockup warnings and potential RCU stall reports. The condition is a denial of service; no privilege escalation or code execution is described in the advisory.

The upstream fix passes nr_to_scan into journal_shrink_one_cp_list() and decrements it for every buffer examined. Checkpoint cleanup paths pass NULL to preserve their full-list semantics. See the Linux Kernel Commit 15cb164 and companion commits 71c6b87, c2c0fb3, and edf5fcd for the exact patch series.

Detection Methods for CVE-2026-89567

Indicators of Compromise

Kernel log entries reporting soft lockup - CPU#N stuck with backtraces referencing journal_shrink_one_cp_list or jbd2_journal_shrink_scan.
RCU stall warnings (rcu: INFO: rcu_sched self-detected stall on CPU) correlating with ext4 write workloads.
Extended contention traces on j_list_lock visible via perf lock or lockstat.

Detection Strategies

Monitor dmesg and /var/log/kern.log for repeated soft lockup or RCU stall messages tied to jbd2 symbols.
Enable kernel tracing on the jbd2 subsystem (/sys/kernel/debug/tracing/events/jbd2/) to correlate shrinker invocations with lock hold times.
Collect uname and package version telemetry across the fleet to identify hosts running unpatched kernel builds.

Monitoring Recommendations

Alert on any node emitting watchdog: BUG: soft lockup messages within a rolling window.
Track ext4 checkpoint list depth and shrinker latency on high-I/O database and storage hosts.
Baseline memory pressure events (vmscan) and correlate with kernel warnings to identify shrinker-induced stalls.

How to Mitigate CVE-2026-89567

Immediate Actions Required

Inventory kernel versions across Linux hosts and prioritize systems running unpatched ext4/jbd2 code.
Apply the upstream stable kernel patches referenced in the vendor commits to production and pre-production systems.
Reboot patched hosts into the fixed kernel; live-patching is not a substitute for kernels that ship the reworked shrinker.

Patch Information

The fix is delivered through the upstream Linux stable tree in commits 15cb164, 71c6b87, c2c0fb3, and edf5fcd. Distribution vendors backport these commits into their supported kernel series; consult your distribution's security tracker for the exact package version that contains the fix.

Workarounds

Reduce sustained memory pressure on ext4-heavy hosts to lower shrinker invocation frequency until patched kernels are deployed.
Where feasible, isolate workloads that generate very large checkpoint transactions to hosts already running fixed kernels.
Monitor for soft lockup and RCU stall messages and schedule proactive reboots on affected hosts to clear degraded state.

bash

# Verify running kernel and check for the fix commits in your distribution's changelog
uname -r

# Inspect recent kernel warnings related to jbd2 shrinker activity
dmesg -T | grep -iE 'jbd2|soft lockup|rcu.*stall'

# Enable jbd2 tracepoints for deeper diagnostics on suspect hosts
echo 1 > /sys/kernel/debug/tracing/events/jbd2/enable