* [CVE-2026-89566][LOW] jbd2: check need_resched() when skipping busy checkpoint buffers
@ 2026-09-12 2:16 21% AL-KERNEL
0 siblings, 0 replies; 1+ results
From: AL-KERNEL @ 2026-09-12 2:16 UTC (permalink / raw)
To: kernel-cve
CVE: CVE-2026-89566
Priority: LOW
AL-KERNEL base severity: LOW
KPANIC flag: NO
Patch: jbd2: check need_resched() when skipping busy checkpoint buffers
Commit: f83c23286e54180cdc83a36463a60003534cc290
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f83c23286e54180cdc83a36463a60003534cc290
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89566
Analysis date: Fri, 11 Sep 2026 22:16:11 -0400
ActionableScore: 2
ActionableScore lower bound: unknown
Actionable bucket: Ordinary Moderate
Manual review required: NO
Summary:
No one-sentence report phrase was found.
======================================================================
ABOUT THIS REPORT
======================================================================
The original Linux kernel CVE announcement for CVE-2026-89566 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89566
The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.
The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.
Published priority for this report: LOW
Manual review required: NO
A detailed explanation of the methodology and priority rules is included
at the end of this message.
======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================
CVE-2026-89566 LOW https://www.kernelcve.org/list/?q=CVE-2026-89566 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H';**CWE-400;CWE-667;CWE-834;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '5.5';DESCR 'jbd2 checkpoint shrinking can hold journal j_list_lock for too long because the busy buffer skip path used continue and skipped the need_resched() check. With large checkpoint lists under memory pressure, this can keep the shrinker running while reschedule is pending and can make other CPUs spin on the same journal lock. For the CVSS the PR:L is selected because a local user can potentially generate filesystem IO and memory pressure, but reliable triggering depends on filesystem state and large mostly busy checkpoint lists. The issue is not network reachable and is not a memory corruption primitive. Impact is denial of service through CPU soft lockups or RCU stalls, with no supported confidentiality or integrity impact.';NO MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 2) YES DEADLOCK DISK SIMPLEFIX HARDWARE DECREASED_TO_LOW_FROM_MODERATE_BASED_ON_ACTIONABLESCORELESSTHAN3 YES NO checked
======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================
ActionableScore=2
PrimitiveClass=CLASS_C
RealUAF=NO
HostAdminRequired=NO
NamespaceScopedPrivilege=NO
ImportantCandidate=NO
ManualReview=NO
AutoDowngradeAllowed=YES
1. ActionableScore
* Raw conservative score: 2
* Conservative score: 2
* Raw paranoid score: 2
* Paranoid score: 2
* Final recommended bucket: **Ordinary Moderate**::
No floor or cap was applied.
2. Signal breakdown
Positive signals:
* +1 Reliable kernel DoS: the patch and commit describe CPU soft lockups or RCU stalls caused by long holding of journal->j_list_lock in journal_shrink_one_cp_list().
* +1 Local below-host-admin reachability: a local user with normal filesystem write and memory allocation ability can plausibly contribute to journal checkpoint growth and memory pressure on an already mounted jbd2/ext4 filesystem.
Negative signals:
* No negative privilege penalty was applied because host-admin-equivalent privilege is not established for the complete runtime condition.
* No race or hard-timing penalty was applied because this is an ordered scheduler/lock-hold issue, not a narrow timing race.
Important non-awarded signals:
* No UAF or stale lifetime primitive is established.
* No concrete repeated release/refcount mutation exists.
* No memory corruption, arbitrary write, controlled reclaim, type confusion, or information leak is established.
* No confidentiality or integrity point is awarded.
* No extra availability point is awarded because soft lockup / RCU stall is already counted as the DoS consequence.
* No remote reachability is established. This is a local filesystem and memory-pressure trigger path.
* No filesystem metadata corruption point is awarded because the bug affects rescheduling while scanning checkpoint buffers, not journal correctness or persistent storage integrity.
3. Reachability analysis
The realistic attacker is a local user or local process able to generate filesystem IO and memory pressure on a system using a jbd2-backed filesystem such as ext4. The vulnerable path is in the shrinker/checkpoint scanning path and is not directly reachable from the network.
Host administrator privilege is not positively required to create normal file IO or memory pressure, assuming the filesystem is already mounted and writable by the attacker. There is no evidence that namespace-scoped capabilities are relevant to the complete trigger. Prior privileged setup exists only in the ordinary sense that the filesystem must already be mounted and in use, which is common deployment state rather than a special attacker prerequisite.
The trigger depends on large checkpoint lists containing mostly busy buffers under memory pressure. This is a workload/state requirement, but it is not a demonstrated narrow race.
4. Primitive and severity interpretation
The exact primitive is a scheduler fairness / lock hold time bug. The busy-buffer path used continue and skipped the need_resched() check, allowing the shrinker to keep walking the checkpoint list while holding journal->j_list_lock.
This is not active structured stale-object use, not fixed stale storage, and not a cleanup UAF. There is no first lifetime operation that can free an object followed by a second refcount or release mutation through the same dangling reference.
PrimitiveClass=CLASS_C because the demonstrated behavior is DoS through soft lockup or RCU stall without an independently useful corruption primitive. The demonstrated consequence is availability impact only. Stronger consequences such as memory corruption, privilege escalation, filesystem ownership violation, or data corruption are not supported by the patch context.
ImportantCandidate=NO because there is no unresolved corruption, ownership, authorization, or lifetime primitive needing Important-vs-Moderate preservation. AutoDowngradeAllowed=YES because this is a DoS-only scheduling/lock-hold issue with no established C/I or exploitation leverage beyond availability.
5. One-sentence report phrase
jbd2 checkpoint shrinking could hold journal->j_list_lock for too long when skipping busy buffers under memory pressure, causing local denial of service through CPU soft lockups or RCU stalls.
6. Manual review recommendation
NO MANUAL CHECK NEEDED
Reason: this is a local DoS-only scheduler/lock-hold issue with no evidence of memory corruption, UAF, repeated refcount mutation, information disclosure, integrity impact, or privilege escalation.
7. Call-site confidence
Call-site confidence: high
======================================================================
UPSTREAM PATCH SUMMARY
======================================================================
Patch: jbd2: check need_resched() when skipping busy checkpoint buffers
Commit: f83c23286e54180cdc83a36463a60003534cc290
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f83c23286e54180cdc83a36463a60003534cc290
Commit description:
journal_shrink_one_cp_list() skips busy checkpoint buffers when called
with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also
skips the need_resched() check at the end of the loop body.
Consequently, when a checkpoint list contains mostly busy buffers, the
shrinker can walk the entire list while holding journal->j_list_lock,
even when a reschedule has been requested. Large checkpoint lists under
memory pressure can therefore cause long lock hold times and leave other
CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls.
Route the busy-buffer path through the need_resched() check so that the
shrinker can release j_list_lock and reschedule promptly, restoring
parity with the clean-buffer path, which already checks need_resched().
This does not change which checkpoint buffers are eligible for removal.
Fixes: b98dba2 ("jbd2: remove journal_clean_one_cp_list()")
Cc: [email protected]
Signed-off-by: Max Kellermann <[email protected]>
Reviewed-by: Zhang Yi <[email protected]>
Reviewed-by: Jan Kara <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Theodore Ts'o <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Changed files:
fs/jbd2/checkpoint.c
Diff excerpt:
Not included in this email. See the upstream URL for the full patch.
Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f83c23286e54180cdc83a36463a60003534cc290
======================================================================
DETAILED REPORT METHODOLOGY
======================================================================
The original Linux kernel CVE announcement for CVE-2026-89566 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89566
The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.
The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.
This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.
The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.
Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:
Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
The Best / paranoid CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The Best / paranoid CVSS score: 5.5
The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.
CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.
A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.
Conservative ActionableScore: unknown
Paranoid ActionableScore: 2
The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.
For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:
ActionableScore below 5 -> MODERATE REGULAR
ActionableScore 5 or more -> MODERATE 7.0
The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.
There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).
KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.
AL-KERNEL base severity for this report: LOW
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): LOW
These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).
Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is [email protected] (and both
send reply to CVE record itself too and see "reply" button below for howto reply).
^ permalink raw reply [relevance 21%]
Results 1-1 of 1 | reverse | sort options + mbox downloads above
-- links below jump to the message on this page --
2026-09-12 2:16 21% [CVE-2026-89566][LOW] jbd2: check need_resched() when skipping busy checkpoint buffers AL-KERNEL
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox