CVE-2026-89566

A flaw was found in the Linux kernel's jbd2 component. When the kernel's journaling block device (jbd2) processes busy checkpoint buffers, it can skip a crucial rescheduling check. This oversight can lead to prolonged holding of a critical lock, causing other central processing units (CPUs) to wait indefinitely. Consequently, this can result in system unresponsiveness, known as soft lockups or RCU stalls, effectively causing a Denial of Service (DoS).

A low impact flaw was found in the Linux kernel's jbd2 journaling layer. When journal_shrink_one_cp_list() skips busy checkpoint buffers (JBD2_SHRINK_BUSY_SKIP), the continue statement on that path also bypasses the need_resched() check at the end of the loop body, so the shrinker can walk an entire checkpoint list while holding journal->j_list_lock even after a reschedule has been requested. Under memory pressure, when a checkpoint list contains mostly busy buffers, a local user able to drive filesystem journal activity can cause long lock hold times that leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls and a denial of service (Red Hat CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The affected products are the Red Hat Enterprise Linux 9 and 10 kernel streams that contain the vulnerable code (rhel-9.6.z, rhel-9.8.z, rhel-9.9, rhel-10.2.z, rhel-10.3, rhel-10.4) and OpenShift Container Platform 4.19 and later through RHCOS 9. Earlier Red Hat Enterprise Linux 7, 8, 9.2, and 9.4 streams, kernel-rt, and OpenShift Container Platform 4.12 through 4.18 (RHCOS 8 and 9) are not affected because the vulnerable code is not present in those kernels. Because this flaw is lower severity, with a CVSS score below the threshold used to prioritize fixes, the fix is deferred for the affected streams; the residual risk is limited to a local denial of service through soft lockups or RCU stalls, with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.