{"schema":"threatline.record/2","record":{"id":"CVE-2026-98538","aliases":[],"summary":"writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes\n\ncleanup_offline_cgwb() prepares at most WB_MAX_INODES_PER_ISW inodes\nper call and is called again until the dying wb is drained, but every\ncall walks wb->b_attached and then wb->b_dirty_time from the same end.\nInodes already prepared (they stay on the list with I_WB_SWITCH set\nuntil the switch worker runs) and inodes that cannot be switched\n(I_FREEING, I_WILL_FREE, !SB_ACTIVE, DAX, already on the target wb)\nstay where they are, so each pass rescans a growing run of them under\nwb->list_lock and a full drain is quadratic in the number of inodes on\nthe list. With ~17M inodes attached to one dying cgwb we saw this end\nin soft lockups, with CPUs reported stuck for 21-48s.\n\nWalk both lists from the oldest end and move every scanned inode to\nthe newest end, so the next pass starts where the previous one stopped\nand the drain becomes linear. b_attached is unordered, so nobody sees\nthe reorder there. b_dirty_time is ordered by dirtied_when, but the\noldest unscanned inode stays at the end move_expired_inodes() picks\nfrom, sync takes the whole list regardless of order, and prepared\ninodes leave the list as soon as the switch work runs and get a new\ndirtied_time_when on the new wb anyway, so the only inodes left out of\norder are the ones that can never switch (DAX), and only on the dying\nwb.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98538","source_modified_at":"2026-10-19T09:21:21.678Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"c22d70a162d3cc177282c4487be4d54876ca55c8","lessThan":"2d1da58c79b66646721a644c6eb4dd1f9c5c9327","status":"affected","versionType":"git"},{"version":"c22d70a162d3cc177282c4487be4d54876ca55c8","lessThan":"c96b4d1628868e1195da1a896f79e06f350a3187","status":"affected","versionType":"git"},{"version":"c22d70a162d3cc177282c4487be4d54876ca55c8","lessThan":"624dd0931162523d70f9db8c120b5ec6429a9b97","status":"affected","versionType":"git"},{"version":"c22d70a162d3cc177282c4487be4d54876ca55c8","lessThan":"dd4b92067238771b604b59fdda8efed6d70ee823","status":"affected","versionType":"git"},{"version":"c22d70a162d3cc177282c4487be4d54876ca55c8","lessThan":"9dac137bf77e0683778fb34c86e730c6129e8cb6","status":"affected","versionType":"git"},{"version":"c22d70a162d3cc177282c4487be4d54876ca55c8","lessThan":"f6988c90671e83db79df1b7b9d6fdb0e5947fd84","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98538","source_modified_at":"2026-10-19T09:21:21.678Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.55","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.9","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98538","source_modified_at":"2026-10-19T09:21:21.678Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"2d1da58c79b66646721a644c6eb4dd1f9c5c9327","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98538","source_modified_at":"2026-10-19T09:21:21.678Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"624dd0931162523d70f9db8c120b5ec6429a9b97","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98538","source_modified_at":"2026-10-19T09:21:21.678Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"9dac137bf77e0683778fb34c86e730c6129e8cb6","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00215,"percentile":0.11256,"score_date":"2026-10-23"},"published_at":"2026-10-18T15:18:05.901Z","modified_at":"2026-10-19T09:21:21.678Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98538","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:21:21.678Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98538","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/2d1da58c79b66646721a644c6eb4dd1f9c5c9327"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/c96b4d1628868e1195da1a896f79e06f350a3187"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/624dd0931162523d70f9db8c120b5ec6429a9b97"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/dd4b92067238771b604b59fdda8efed6d70ee823"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/9dac137bf77e0683778fb34c86e730c6129e8cb6"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/f6988c90671e83db79df1b7b9d6fdb0e5947fd84"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:21:21.678Z","content_hash":"6027d93a1ed01e458f9d82525fa5ce1f0343182b3969720050b65d6f54e24ca0"}}