CVE-2026-90434

In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofs_fill_pages() reads the compressed block pointer table. The error paths release the current buffer_head, the loop also releases the old buffer_head when it advances. However, the success path leaves the last buffer_head referenced. Release it before returning success.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/0c2c54a7d174edc845f7bae24179fe72a926d10f
https://git.kernel.org/stable/c/106e1a3b2b3454fbda63a59e9290cb9a253f81aa
https://git.kernel.org/stable/c/2f7dd9b86fe4076059e6a4a2a2c5d565afd76b9e
https://git.kernel.org/stable/c/3371d30a97a257b7b5f2c8009612e9d452180f0a
https://git.kernel.org/stable/c/5677737c2cedf417c0fcf61540b9cef0e62273d4
https://git.kernel.org/stable/c/dbcc7d1b818162aeab2e97fd217d86546d9fde15
https://git.kernel.org/stable/c/ec33e6b7a1de20d7e623b12633191a855445657d
https://git.kernel.org/stable/c/f2a1611065c700a374b31c5cc8a7587f5e3bfe73

Configurations

No configuration.

History

17 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 17:17

Updated : 2026-09-17 17:17

NVD link : CVE-2026-90434

Mitre link : CVE-2026-90434

CVE.ORG link : CVE-2026-90434

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-90434", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "dbcc7d1b818162aeab2e97fd217d86546d9fde15", "versionType": "git"}, {"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "ec33e6b7a1de20d7e623b12633191a855445657d", "versionType": "git"}, {"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "0c2c54a7d174edc845f7bae24179fe72a926d10f", "versionType": "git"}, {"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "5677737c2cedf417c0fcf61540b9cef0e62273d4", "versionType": "git"}, {"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "f2a1611065c700a374b31c5cc8a7587f5e3bfe73", "versionType": "git"}, {"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "106e1a3b2b3454fbda63a59e9290cb9a253f81aa", "versionType": "git"}, {"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "3371d30a97a257b7b5f2c8009612e9d452180f0a", "versionType": "git"}, {"status": "affected", "version": "59bc055211b8d266ab6089158058bf8268e02006", "lessThan": "2f7dd9b86fe4076059e6a4a2a2c5d565afd76b9e", "versionType": "git"}], "programFiles": ["fs/isofs/compress.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.33"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.33", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.110", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.52", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.6", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/isofs/compress.c"], "defaultStatus": "affected"}]}], "published": "2026-09-17T17:17:48.597", "references": [{"url": "https://git.kernel.org/stable/c/0c2c54a7d174edc845f7bae24179fe72a926d10f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/106e1a3b2b3454fbda63a59e9290cb9a253f81aa", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2f7dd9b86fe4076059e6a4a2a2c5d565afd76b9e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3371d30a97a257b7b5f2c8009612e9d452180f0a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5677737c2cedf417c0fcf61540b9cef0e62273d4", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dbcc7d1b818162aeab2e97fd217d86546d9fde15", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ec33e6b7a1de20d7e623b12633191a855445657d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f2a1611065c700a374b31c5cc8a7587f5e3bfe73", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: release zisofs block pointer buffer head\n\nzisofs_fill_pages() reads the compressed block pointer table. The error\npaths release the current buffer_head, the loop also releases the old\nbuffer_head when it advances. However, the success path leaves the last\nbuffer_head referenced. Release it before returning success."}], "lastModified": "2026-09-17T17:17:48.597", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}