Executive brief
The Linux kernel's ISO 9660 compressed file system (zisofs) implementation contains a memory leak in the buffer management code. When reading compressed block pointer tables, the code fails to release a memory buffer on the success path, causing kernel memory to accumulate over time. This can lead to system instability and eventual denial of service through memory exhaustion.
Technical details
The vulnerability is a memory leak in the zisofs_fill_pages() function in fs/isofs/compress.c. The function reads a compressed block pointer table and properly releases buffer_head structures on error paths and during normal loop iteration, but fails to release the final buffer_head on the success path before returning. An attacker can trigger this by repeatedly reading from a specially crafted ISO 9660 compressed file system, causing kernel memory exhaustion. The fix is a single line adding brelse(bh) before the success return statement.
Affected products
- Linux Linux kernel 2.6.11 through 6.18 and later
Timeline
- 2026-09-17: disclosed
- 2026-07-21: patched