In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes… (CVE-2026-98538)

The vulnerability in the Linux kernel's writeback subsystem involved the cleanup_offline_cgwb() function, which prepares at most WB_MAX_INODES_PER_ISW inodes per call and is repeatedly called until the dying writeback (wb) is drained. Each call rescans the wb->b_attached and wb->b_dirty_time lists from the same end, causing inodes that cannot be switched or are already prepared to remain on the list. This results in a quadratic time complexity for draining the list, which can lead to soft lockups when a large number of inodes (~17 million) are attached to a dying cgwb. The fix involves walking both lists from the oldest end and moving each scanned inode to the newest end, making the drain process linear in complexity and preventing CPU soft lockups.

The vulnerability can cause soft lockups in the Linux kernel due to excessive CPU time spent rescanning inodes during writeback cleanup. This results in CPUs being reported as stuck for durations between 21 to 48 seconds, potentially affecting system responsiveness and stability under heavy inode writeback conditions.

A fix has been implemented in the Linux kernel to address this issue by changing the inode scanning order to linearize the cleanup process. Users should apply the official kernel update or patch that includes this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the current remediation guidance.