CVE-2026-23238

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23238
In the Linux kernel, the following vulnerability has been resolved: romfs: check sb_set_blocksize() return value romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size is incompatible with the block device's configuration. This can be triggered by setting a loop device's block size larger than PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical_block_size=32768, bdev_validate_blocksize() fails because the requested size is smaller than the device's logical block size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and continues mounting. The superblock's block size remains at the device's logical block size (32768). Later, when sb_bread() attempts I/O with this oversized block size, it triggers a kernel BUG in folio_set_bh(): kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Fix by checking the return value of sb_set_blocksize() and failing the mount with -EINVAL if it returns 0.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2c5829cd8fbbc91568c520b666898f57cdcb8cf6 Patch
https://git.kernel.org/stable/c/4b71ad7676564a94ec5f7d18298f51e8ae53db73 Patch
https://git.kernel.org/stable/c/9b203b8ddd7359270e8a694d0584743555128e2c Patch
https://git.kernel.org/stable/c/a381f0f61b35c8894b0bd0d6acef2d8f9b08b244 Patch
https://git.kernel.org/stable/c/ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 Patch
https://git.kernel.org/stable/c/cbd9931e6456822067725354d83446c5bb813030 Patch
https://git.kernel.org/stable/c/f2521ab1f63a8c244f06a080319e5ff9a2e1bd95 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
History

17 Mar 2026, 21:15

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/2c5829cd8fbbc91568c520b666898f57cdcb8cf6 - () https://git.kernel.org/stable/c/2c5829cd8fbbc91568c520b666898f57cdcb8cf6 - Patch
References () https://git.kernel.org/stable/c/4b71ad7676564a94ec5f7d18298f51e8ae53db73 - () https://git.kernel.org/stable/c/4b71ad7676564a94ec5f7d18298f51e8ae53db73 - Patch
References () https://git.kernel.org/stable/c/9b203b8ddd7359270e8a694d0584743555128e2c - () https://git.kernel.org/stable/c/9b203b8ddd7359270e8a694d0584743555128e2c - Patch
References () https://git.kernel.org/stable/c/a381f0f61b35c8894b0bd0d6acef2d8f9b08b244 - () https://git.kernel.org/stable/c/a381f0f61b35c8894b0bd0d6acef2d8f9b08b244 - Patch
References () https://git.kernel.org/stable/c/ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 - () https://git.kernel.org/stable/c/ab7ad7abb3660c58ffffdf07ff3bb976e7e0afa0 - Patch
References () https://git.kernel.org/stable/c/cbd9931e6456822067725354d83446c5bb813030 - () https://git.kernel.org/stable/c/cbd9931e6456822067725354d83446c5bb813030 - Patch
References () https://git.kernel.org/stable/c/f2521ab1f63a8c244f06a080319e5ff9a2e1bd95 - () https://git.kernel.org/stable/c/f2521ab1f63a8c244f06a080319e5ff9a2e1bd95 - Patch
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: romfs: verificar el valor de retorno de sb_set_blocksize() romfs_fill_super() ignora el valor de retorno de sb_set_blocksize(), lo cual puede fallar si el tamaño de bloque solicitado es incompatible con la configuración del dispositivo de bloques. Esto puede ser activado al establecer el tamaño de bloque de un dispositivo de bucle mayor que PAGE_SIZE usando ioctl(LOOP_SET_BLOCK_SIZE, 32768), y luego montando un sistema de archivos romfs en ese dispositivo. Cuando se llama a sb_set_blocksize(sb, ROMBSIZE) con ROMBSIZE=4096 pero el dispositivo tiene logical_block_size=32768, bdev_validate_blocksize() falla porque el tamaño solicitado es menor que el tamaño de bloque lógico del dispositivo. sb_set_blocksize() devuelve 0 (falla), pero romfs ignora esto y continúa el montaje. El tamaño de bloque del superbloque permanece en el tamaño de bloque lógico del dispositivo (32768). Más tarde, cuando sb_bread() intenta E/S con este tamaño de bloque sobredimensionado, activa un BUG del kernel en folio_set_bh(): BUG del kernel en fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE); Solución al verificar el valor de retorno de sb_set_blocksize() y fallar el montaje con -EINVAL si devuelve 0.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-617

04 Mar 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-04 15:16

Updated : 2026-03-17 21:15

NVD link : CVE-2026-23238

Mitre link : CVE-2026-23238

CVE.ORG link : CVE-2026-23238

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-617

Reachable Assertion