CVE-2026-89759

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup when scanning task stacks Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3. kmemleak_scan() scans every task stack under one rcu_read_lock() with no reschedule point, which can trip the soft lockup watchdog on hosts with very many threads. That prints the following message, depending on the workload+host configuration: watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537] scan_block kmemleak_scan kmemleak_scan_thread kthread Patch 1 walks the tasks with find_ge_pid() so the scan reschedules between tasks Patches 2-3 let the scan loops stop early once a scan is interrupted. This patch (of 3): kmemleak_scan() walks every thread and scans its kernel stack under a single rcu_read_lock() with no reschedule point. On a host with very many threads -- amplified by KASAN/lockdep in debug builds -- this loop can hog a CPU long enough to trip the soft lockup watchdog: watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537] scan_block kmemleak_scan kmemleak_scan_thread kthread A cond_resched() cannot be added directly: the loop runs inside an RCU read-side critical section. Walk the tasks one PID at a time with find_ge_pid(), taking the RCU read lock only to look up and pin each task. The stack is then scanned with no lock held, so cond_resched() runs between tasks and the scan stops early on scan_should_stop(). This follows the next_tgid()/task_seq_get_next() iteration pattern and keeps each RCU critical section short.

Package Linux Kernel
Published 2026-09-11
Last modified 2026-09-11
Patch available
Yes

Affected versions

Linux kernel versions 5.10 and later are affected. Fixed in 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 and their respective stable series.

Affected from
≥ 5.10
Fixed in
✓ 6.12.109 6.12.x ✓ 6.18.50 6.18.x ✓ 7.2.4 7.2.x ✓ 7.3-rc1

Frequently asked questions

  • What is CVE-2026-89759?

    CVE-2026-89759 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10 onward and has been patched in 6.12.109, 6.18.50, 7.2.4 and others. CVE-2026-89759 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • Is there a patch available for CVE-2026-89759?

    Yes. CVE-2026-89759 has been patched. Fixed versions include 6.12.109, 6.18.50, 7.2.4 and others. If you are running Linux kernel 5.10 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-89759 actively exploited?

    No. CVE-2026-89759 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.