You certainly are distributing the GPL-licensed work to the reviewer. "Internal" non-distribution conveyance only occurs between agents of the same legal corporation (persona ficta) because it doesn't leave the possession of the corporate person. That does not occur here.
In the simplest case, you are not forbidden to tell the reviewer, "I must tell you: I cannot and will not forbid you from distributing this software." And the reviewer will surely say in reply, "Thanks, if early release of this software is worth forever destroying my academic career, I'll think about employing that option." And there is no GPL violation: the reviewers badly want to ensure that they do not share your software, for the safety of their own careers.
The legal specifics of more complex cases will probably come down to what specific contracts are enacted between the parties involved (you, the reviewer, and the journal publisher).
In the event that you give your code directly to a reviewer, and that reviewer has a separate contract with the publisher not to share reviewed material, I don't see a GPL violation here, because no distributor of GPL'd work is attempting to impose restrictions on redistribution. If the publisher acts as a proxy between you and the reviewer and gives the work to the reviewer themselves, and such a contract is in effect, then they probably commit a GPL violation.
It's possible that you give the work directly to the reviewer, and there exists a legal contract between you and the publisher asserting that you will not grant reviewers the rights to redistribute the software. This would put you in the position of either violating the upstream author's GPL grant or violating your contract with the publisher.
One possible exception to this last case: the GPLv3 does handle this case for contractors hired to make modifications and for remote code-hosting/execution platforms (e.g., Amazon Web Services):
You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
If we can say that reviewers fall under the broad category of parties who receive your code for "the sole purpose of having them make modifications exclusively for you" then the GPLv3 would allow this particular restriction. (The GPLv2 would not.) Whether or not reviewer feedback on software constitutes "making modifications" under this provision isn't clearly settled for me, but I can surely see a strong argument in favor of it (e.g., they might indeed offer improvements, and there isn't an expectation they'd want to redistribute the work further, much like a contractor).