CVE-2026-89567

A flaw was found in the Linux kernel's jbd2 shrinker. This component, which manages journal buffers, does not correctly account for busy checkpoint buffers. This oversight can cause the shrinker to hold a critical system lock for an extended period when processing many busy buffers. The prolonged lock contention can lead to system unresponsiveness, such as soft lockups or RCU stalls, ultimately resulting in a Denial of Service (DoS).

A MODERATE severity denial of service flaw was found in the jbd2 journaling subsystem of the Linux kernel, which Red Hat ships in the kernel packages of Red Hat Enterprise Linux and in the Red Hat Enterprise Linux CoreOS (RHCOS) kernel used by OpenShift Container Platform. The jbd2 shrinker counts only checkpoint buffers that it successfully releases against its scan budget, so busy buffers do not consume it. When a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_lock; on systems with large checkpoint lists this causes excessive lock hold times that leave other CPUs spinning on the lock, resulting in soft lockups, RCU stalls, and a denial of service. Exploitation requires local access to a system whose journal has built up a large checkpoint list containing mostly busy buffers, conditions that can arise under sustained memory pressure on a journaled filesystem; only availability is affected, with no impact on confidentiality or integrity (Red Hat CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Current Red Hat Enterprise Linux 9 and 10 kernel streams and OpenShift Container Platform 4.19 and later streams (including 5.x) are affected. Older Red Hat Enterprise Linux 7 and 8 streams and earlier Red Hat Enterprise Linux 9 minor streams, as well as OpenShift Container Platform 4.12 through 4.18, are not affected because the vulnerable code is not present in their kernels. For the affected streams the fix is currently deferred because the MODERATE impact and CVSS score below 7.0 do not meet the threshold for prioritizing an update; the residual risk is that a local user could cause temporary system unresponsiveness on systems experiencing the journal checkpoint conditions described above.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.