From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-89566][LOW] jbd2: check need_resched() when skipping busy checkpoint buffers Date: Fri, 11 Sep 2026 22:16:11 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-89566 X-AL-KERNEL-Priority: LOW X-AL-KERNEL-Severity: LOW X-AL-KERNEL-Base-Severity: LOW X-AL-KERNEL-KPANIC: NO X-AL-KERNEL-ActionableScore: 2 X-AL-KERNEL-ActionableScore-Lower: unknown X-AL-KERNEL-Commit: f83c23286e54180cdc83a36463a60003534cc290 List-Id: CVE: CVE-2026-89566 Priority: LOW AL-KERNEL base severity: LOW KPANIC flag: NO Patch: jbd2: check need_resched() when skipping busy checkpoint buffers Commit: f83c23286e54180cdc83a36463a60003534cc290 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f83c23286e54180cdc83a36463a60003534cc290 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89566 Analysis date: Fri, 11 Sep 2026 22:16:11 -0400 ActionableScore: 2 ActionableScore lower bound: unknown Actionable bucket: Ordinary Moderate Manual review required: NO Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-89566 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89566 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: LOW Manual review required: NO A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-89566 LOW https://www.kernelcve.org/list/?q=CVE-2026-89566 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H';**CWE-400;CWE-667;CWE-834;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '5.5';DESCR 'jbd2 checkpoint shrinking can hold journal j_list_lock for too long because the busy buffer skip path used continue and skipped the need_resched() check. With large checkpoint lists under memory pressure, this can keep the shrinker running while reschedule is pending and can make other CPUs spin on the same journal lock. For the CVSS the PR:L is selected because a local user can potentially generate filesystem IO and memory pressure, but reliable triggering depends on filesystem state and large mostly busy checkpoint lists. The issue is not network reachable and is not a memory corruption primitive. Impact is denial of service through CPU soft lockups or RCU stalls, with no supported confidentiality or integrity impact.';NO MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 2) YES DEADLOCK DISK SIMPLEFIX HARDWARE DECREASED_TO_LOW_FROM_MODERATE_BASED_ON_ACTIONABLESCORELESSTHAN3 YES NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=2 PrimitiveClass=CLASS_C RealUAF=NO HostAdminRequired=NO NamespaceScopedPrivilege=NO ImportantCandidate=NO ManualReview=NO AutoDowngradeAllowed=YES 1. ActionableScore * Raw conservative score: 2 * Conservative score: 2 * Raw paranoid score: 2 * Paranoid score: 2 * Final recommended bucket: **Ordinary Moderate**:: No floor or cap was applied. 2. Signal breakdown Positive signals: * +1 Reliable kernel DoS: the patch and commit describe CPU soft lockups or RCU stalls caused by long holding of journal->j_list_lock in journal_shrink_one_cp_list(). * +1 Local below-host-admin reachability: a local user with normal filesystem write and memory allocation ability can plausibly contribute to journal checkpoint growth and memory pressure on an already mounted jbd2/ext4 filesystem. Negative signals: * No negative privilege penalty was applied because host-admin-equivalent privilege is not established for the complete runtime condition. * No race or hard-timing penalty was applied because this is an ordered scheduler/lock-hold issue, not a narrow timing race. Important non-awarded signals: * No UAF or stale lifetime primitive is established. * No concrete repeated release/refcount mutation exists. * No memory corruption, arbitrary write, controlled reclaim, type confusion, or information leak is established. * No confidentiality or integrity point is awarded. * No extra availability point is awarded because soft lockup / RCU stall is already counted as the DoS consequence. * No remote reachability is established. This is a local filesystem and memory-pressure trigger path. * No filesystem metadata corruption point is awarded because the bug affects rescheduling while scanning checkpoint buffers, not journal correctness or persistent storage integrity. 3. Reachability analysis The realistic attacker is a local user or local process able to generate filesystem IO and memory pressure on a system using a jbd2-backed filesystem such as ext4. The vulnerable path is in the shrinker/checkpoint scanning path and is not directly reachable from the network. Host administrator privilege is not positively required to create normal file IO or memory pressure, assuming the filesystem is already mounted and writable by the attacker. There is no evidence that namespace-scoped capabilities are relevant to the complete trigger. Prior privileged setup exists only in the ordinary sense that the filesystem must already be mounted and in use, which is common deployment state rather than a special attacker prerequisite. The trigger depends on large checkpoint lists containing mostly busy buffers under memory pressure. This is a workload/state requirement, but it is not a demonstrated narrow race. 4. Primitive and severity interpretation The exact primitive is a scheduler fairness / lock hold time bug. The busy-buffer path used continue and skipped the need_resched() check, allowing the shrinker to keep walking the checkpoint list while holding journal->j_list_lock. This is not active structured stale-object use, not fixed stale storage, and not a cleanup UAF. There is no first lifetime operation that can free an object followed by a second refcount or release mutation through the same dangling reference. PrimitiveClass=CLASS_C because the demonstrated behavior is DoS through soft lockup or RCU stall without an independently useful corruption primitive. The demonstrated consequence is availability impact only. Stronger consequences such as memory corruption, privilege escalation, filesystem ownership violation, or data corruption are not supported by the patch context. ImportantCandidate=NO because there is no unresolved corruption, ownership, authorization, or lifetime primitive needing Important-vs-Moderate preservation. AutoDowngradeAllowed=YES because this is a DoS-only scheduling/lock-hold issue with no established C/I or exploitation leverage beyond availability. 5. One-sentence report phrase jbd2 checkpoint shrinking could hold journal->j_list_lock for too long when skipping busy buffers under memory pressure, causing local denial of service through CPU soft lockups or RCU stalls. 6. Manual review recommendation NO MANUAL CHECK NEEDED Reason: this is a local DoS-only scheduler/lock-hold issue with no evidence of memory corruption, UAF, repeated refcount mutation, information disclosure, integrity impact, or privilege escalation. 7. Call-site confidence Call-site confidence: high ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: jbd2: check need_resched() when skipping busy checkpoint buffers Commit: f83c23286e54180cdc83a36463a60003534cc290 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f83c23286e54180cdc83a36463a60003534cc290 Commit description: journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffers, the shrinker can walk the entire list while holding journal->j_list_lock, even when a reschedule has been requested. Large checkpoint lists under memory pressure can therefore cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. Route the busy-buffer path through the need_resched() check so that the shrinker can release j_list_lock and reschedule promptly, restoring parity with the clean-buffer path, which already checks need_resched(). This does not change which checkpoint buffers are eligible for removal. Fixes: b98dba2 ("jbd2: remove journal_clean_one_cp_list()") Cc: stable@vger.kernel.org Signed-off-by: Max Kellermann Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20260713102229.1598812-2-max.kellermann@ionos.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Changed files: fs/jbd2/checkpoint.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f83c23286e54180cdc83a36463a60003534cc290 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-89566 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-89566 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS score: 5.5 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: unknown Paranoid ActionableScore: 2 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: LOW KPANIC detected for this report: NO Published priority for this report (same as in Subject): LOW These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).