CVE-2026-23238

Description

In the Linux kernel, the following vulnerability has been resolved:romfs: check sb_set_blocksize() return valueromfs_fill_super() ignores the return value of sb_set_blocksize(), whichcan fail if the requested block size is incompatible with the blockdevices configuration.This can be triggered by setting a loop devices block size larger thanPAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfsfilesystem on that device.When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but thedevice has logical_block_size=32768, bdev_validate_blocksize() failsbecause the requested size is smaller than the devices logical blocksize. sb_set_blocksize() returns 0 (failure), but romfs ignores this andcontinues mounting.The superblocks block size remains at the devices logical block size(32768). Later, when sb_bread() attempts I/O with this oversized blocksize, it triggers a kernel BUG in folio_set_bh(): kernel BUG at fs/buffer.c:1582! BUG_ON(size > PAGE_SIZE);Fix by checking the return value of sb_set_blocksize() and failing themount with -EINVAL if it returns 0.

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234