VulnerabilityPublished 18 Oct 2026

CVE-2026-98538: Linux kernel · writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes

Source GCVE Database

Authoritative record:CVE-2026-98538· Medium

Not known to be exploited · fixed in f6988c90671e83db79df1b7b9d6fdb0e5947fd84 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f6988c90671e83db79df1b7b9d6fdb0e5947fd84, dd4b92067238771b604b59fdda8efed6d70ee823, c96b4d1628868e1195da1a896f79e06f350a3187 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-m444-q4wx-jpmh

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < f6988c90671e83db79df1b7b9d6fdb0e5947fd84	Fixed in f6988c90671e83db79df1b7b9d6fdb0e5947fd84
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < dd4b92067238771b604b59fdda8efed6d70ee823	Fixed in dd4b92067238771b604b59fdda8efed6d70ee823
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < c96b4d1628868e1195da1a896f79e06f350a3187	Fixed in c96b4d1628868e1195da1a896f79e06f350a3187
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < 624dd0931162523d70f9db8c120b5ec6429a9b97	Fixed in 624dd0931162523d70f9db8c120b5ec6429a9b97
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < 9dac137bf77e0683778fb34c86e730c6129e8cb6	Fixed in 9dac137bf77e0683778fb34c86e730c6129e8cb6
LinuxLinux	Affected ≥ c22d70a162d3cc177282c4487be4d54876ca55c8, < 2d1da58c79b66646721a644c6eb4dd1f9c5c9327	Fixed in 2d1da58c79b66646721a644c6eb4dd1f9c5c9327

AI-suggested

A fix has been implemented in the Linux kernel to address this issue by changing the inode scanning order to linearize the cleanup process. Users should apply the official kernel update or patch that includes this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the current remediation guidance.

Description

A vulnerability in the Linux kernel's writeback mechanism involving the cleanup_offline_cgwb() function has been resolved. The issue caused rescans of inodes to be quadratic in complexity due to repeated scanning of inodes that remain on the list, leading to potential soft lockups with CPUs stuck for extended periods. The fix changes the scanning approach to linear by reordering inodes during processing, preventing excessive rescanning and improving performance.

Impact

The vulnerability can cause soft lockups in the Linux kernel due to excessive CPU time spent rescanning inodes during writeback cleanup. This results in CPUs being reported as stuck for durations between 21 to 48 seconds, potentially affecting system responsiveness and stability under heavy inode writeback conditions.

Summary

The vulnerability in the Linux kernel's writeback subsystem involved the cleanup_offline_cgwb() function, which prepares at most WB_MAX_INODES_PER_ISW inodes per call and is repeatedly called until the dying writeback (wb) is drained. Each call rescans the wb->b_attached and wb->b_dirty_time lists from the same end, causing inodes that cannot be switched or are already prepared to remain on the list. This results in a quadratic time complexity for draining the list, which can lead to soft lockups when a large number of inodes (~17 million) are attached to a dying cgwb. The fix involves walking both lists from the oldest end and moving each scanned inode to the newest end, making the drain process linear in complexity and preventing CPU soft lockups.

References

Community reviews

Loading reviews…