CVE-2026-98538
Received Received - Intake

Linux kernel writeback cleanup_offline_cgwb() inode rescan issue

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes cleanup_offline_cgwb() prepares at most WB_MAX_INODES_PER_ISW inodes per call and is called again until the dying wb is drained, but every call walks wb->b_attached and then wb->b_dirty_time from the same end. Inodes already prepared (they stay on the list with I_WB_SWITCH set until the switch worker runs) and inodes that cannot be switched (I_FREEING, I_WILL_FREE, !SB_ACTIVE, DAX, already on the target wb) stay where they are, so each pass rescans a growing run of them under wb->list_lock and a full drain is quadratic in the number of inodes on the list. With ~17M inodes attached to one dying cgwb we saw this end in soft lockups, with CPUs reported stuck for 21-48s. Walk both lists from the oldest end and move every scanned inode to the newest end, so the next pass starts where the previous one stopped and the drain becomes linear. b_attached is unordered, so nobody sees the reorder there. b_dirty_time is ordered by dirtied_when, but the oldest unscanned inode stays at the end move_expired_inodes() picks from, sync takes the whole list regardless of order, and prepared inodes leave the list as soon as the switch work runs and get a new dirtied_time_when on the new wb anyway, so the only inodes left out of order are the ones that can never switch (DAX), and only on the dying wb.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98538
EUVD
EUVD-2026-103583

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux c22d70a162d3cc177282c4487be4d54876ca55c8
Linux Linux 5.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where cleanup_offline_cgwb() inefficiently rescans inodes during writeback cleanup. It repeatedly processes the same inodes due to improper list traversal, causing quadratic time complexity. With many inodes, this leads to soft lockups and long CPU stalls (21-48 seconds).

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to inode handling during writeback cleanup. Detection requires checking kernel logs for soft lockups or excessive CPU usage during writeback operations. Monitor for processes stuck in 'D' state or system unresponsiveness during heavy I/O operations.

Impact Analysis

The vulnerability causes system freezes or hangs during writeback cleanup, especially with large numbers of inodes. This leads to unresponsive systems, application timeouts, and potential data processing delays.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If immediate patching isn't possible, reduce system load during writeback operations and monitor for soft lockups. Consider isolating workloads with high inode churn until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98538. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart