CVE-2026-90434

What it actually does

Missing buffer_head put in the success return path of zisofs_fill_pages() leaves the final buffer_head reference held after reading the zisofs compressed block pointer table from an ISO filesystem.

Why it matters to the business

Systems that repeatedly access zisofs-compressed ISO images experience gradual kernel memory exhaustion, which can degrade performance or cause denial of service in environments that mount or serve such images.

How an attack unfolds

An attacker supplies or causes the kernel to read from a zisofs-compressed ISO, triggering zisofs_fill_pages() on every successful read; because the success path omits the final buffer_head release, each operation leaks a small kernel resource until memory pressure becomes noticeable.

How to fix it

Apply the upstream Linux kernel commit that adds the missing buffer_head release on the success path of zisofs_fill_pages(); rebuild and deploy the fixed kernel on all affected systems.

How to confirm the fix worked

Inspect the patched zisofs.c source to confirm the buffer_head is released before the success return; alternatively, exercise zisofs reads while monitoring buffer_head slab usage with slabtop or /proc/slabinfo to verify the leak is closed.

Typical attack path

1. Cause the target to mount or open a zisofs-compressed ISO9660 image
2. Perform repeated file reads that invoke zisofs_fill_pages()
3. Accumulate unreleased buffer_head references until kernel memory is depleted

How to detect it

Review kernel logs for zisofs activity combined with steady growth in buffer_head or page cache slab objects; correlate with processes that mount or read ISO images.

What your security team should do

• Prioritize kernel updates on any system that may mount zisofs images
• Restrict mounting of untrusted ISO images until patches are deployed
• Add kernel memory usage alerts for buffer_head and page cache slabs