CVE-2026-89759

Unknown

Description

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleak_scan() scans every task stack under one rcu_read_lock() with no reschedule point, which can trip the soft lockup watchdog on hosts with very many threads. That prints the following message, depending on the workload+host configuration: watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537] scan_block kmemleak_scan kmemleak_scan_thread kthread Patch 1 walks the tasks with find_ge_pid() so the scan reschedules between tasks Patches 2-3 let the scan loops stop early once a scan is interrupted. This patch (of 3): kmemleak_scan() walks every thread and scans its kernel stack under a single rcu_read_lock() with no reschedule point. On a host with very many threads -- amplified by KASAN/lockdep in debug builds -- this loop can hog a CPU long enough to trip the soft lockup watchdog: watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537] scan_block kmemleak_scan kmemleak_scan_thread kthread A cond_resched() cannot be added directly: the loop runs inside an RCU read-side critical section. Walk the tasks one PID at a time with find_ge_pid(), taking the RCU read lock only to look up and pin each task. The stack is then scanned with no lock held, so cond_resched() runs between tasks and the scan stops early on scan_should_stop(). This follows the next_tgid()/task_seq_get_next() iteration pattern and keeps each RCU critical section short.

SeverityUnknown
CVSS—
Exploit probability—
ProductLinux
PublishedSep 11, 2026
First seenSep 11, 2026

How to fix

Update
  • Linux Linux2567818c2776d0a820506c3612261d9e24af7164, f1cd6c4c35243377882c47236281d03ee3be6eeb, 9a1b12c06c192290b8479de48f66f1e75d89c4b7, 3fc8044251de21555fb02c365fa681bab8b0db55, 1838c704bcb4fd3556cf67513c6f97a39099e35c, 5d10d4e19e6daa487f0cd0ea6cba472325de92f9 or later

Affected products

ProductAffected versionsFixed in
Linux Linuxc4b28963fd79457315783b3b0f21c01eb88cfdc1 ≤ v < 2567818c2776d0a820506c3612261d9e24af7164, c4b28963fd79457315783b3b0f21c01eb88cfdc1 ≤ v < f1cd6c4c35243377882c47236281d03ee3be6eeb, c4b28963fd79457315783b3b0f21c01eb88cfdc1 ≤ v < 9a1b12c06c192290b8479de48f66f1e75d89c4b7, c4b28963fd79457315783b3b0f21c01eb88cfdc1 ≤ v < 3fc8044251de21555fb02c365fa681bab8b0db55, c4b28963fd79457315783b3b0f21c01eb88cfdc1 ≤ v < 1838c704bcb4fd3556cf67513c6f97a39099e35c, c4b28963fd79457315783b3b0f21c01eb88cfdc1 ≤ v < 5d10d4e19e6daa487f0cd0ea6cba472325de92f9, 5.102567818c2776d0a820506c3612261d9e24af7164, f1cd6c4c35243377882c47236281d03ee3be6eeb, 9a1b12c06c192290b8479de48f66f1e75d89c4b7, 3fc8044251de21555fb02c365fa681bab8b0db55, 1838c704bcb4fd3556cf67513c6f97a39099e35c, 5d10d4e19e6daa487f0cd0ea6cba472325de92f9

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.