Soft Lockup Vulnerability in Linux Kernel Affecting Multi-threaded Systems

CVE-2026-89759

What is CVE-2026-89759?

A vulnerability in the Linux kernel's kmemleak component can cause significant delays in multi-threaded systems by leading to a soft lockup condition. This occurs when the kmemleak_scan function scans every task stack under a single rcu_read_lock without any reschedule points, potentially causing high CPU usage on systems with many threads, especially in debug builds using KASAN or lockdep. The issue triggers watchdog alerts indicating that a specific CPU has been stuck for an excessive duration. The solution is a series of patches that allow the kmemleak scan to reschedule between tasks, thereby preventing the CPU hogging that leads to soft lockup, ensuring smoother operation even in heavily threaded environments.

References