CVE-2026-89567

In the Linux kernel, the following vulnerability has been resolved:

jbd2: bound shrinker scans by examined checkpoint buffers

The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr to scan. Busy buffers therefore do not consume the scan budget.

If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j list lock. Large checkpoint lists can result in excessive lock hold times and leave other CPUs spinning on j list lock, causing soft lockups or RCU stalls.

Pass nr to scan into journal shrink one cp list() and decrement it for every buffer examined, including busy buffers. Pass NULL from checkpoint cleanup paths so their existing full-list behavior is preserved.

This restores the scan-budget semantics that existed before journal shrink one cp list() was changed to always scan a complete checkpoint list.