UBUNTU-CVE-2026-89567: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nrtoscan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->jlistlock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on jlistlock, causing soft lockups or RCU stalls. Pass nrtoscan into journalshrinkonecplist() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved. This restores the scan-budget semantics that existed before journalshrinkonecplist() was changed to always scan a complete checkpoint list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are most likely to experience impact from this issue?
Systems using an affected Ubuntu Linux kernel variant are exposed when they have large jbd2 checkpoint lists containing many busy buffers. The impact is excessive time holding journal->j_list_lock, which can cause other CPUs to spin and may lead to soft lockups or RCU stalls.
Does exploiting this require remote access or user interaction?
The provided vector indicates local access, low attack complexity, low privileges, and no user interaction. The data does not specify the exact local actions needed to create the required checkpoint-buffer conditions.
What operational symptoms could indicate exposure?
Potential indicators are soft lockup reports or RCU stall warnings associated with long contention on journal->j_list_lock. The issue is triggered when shrinker scans encounter mostly busy checkpoint buffers and continue scanning a large checkpoint list.
Is there a workaround if an updated kernel cannot be deployed immediately?
No workaround or mitigation is provided in the available data. The described fix bounds shrinker scans by counting every examined checkpoint buffer against the scan budget.