PT-2026-22924 · Linux · Linux Kernel

Published 2026-03-04 · Updated 2026-04-20 · CVE-2026-23238

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel has an issue where romfs fill super() does not check the return value of sb set blocksize(). This can lead to a kernel BUG in folio set bh() if a loop device's block size is set larger than PAGE SIZE using ioctl(LOOP SET BLOCK SIZE, 32768) and a romfs filesystem is mounted on that device. Specifically, if sb set blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the device has logical block size=32768, bdev validate blocksize() fails, sb set blocksize() returns 0, but the mount process continues, resulting in an oversized block size being used during I/O operations. The vulnerable function is romfs fill super(). The issue is triggered when the requested block size is incompatible with the block device's configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-23238

ECHO-ADFD-5585-803E

Affected Products

Linux Kernel

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23238.json · Exploit
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-23238 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23238 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23238 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-23238 · Vendor Advisory
• https://git.kernel.org/stable/c/f2521ab1f63a8c244f06a080319e5ff9a2e1bd95 · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-23238 · Vendor Advisory
• https://git.kernel.org/stable/c/cbd9931e6456822067725354d83446c5bb813030 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23238 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23238 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23238 · Vendor Advisory
• https://git.kernel.org/stable/c/2c5829cd8fbbc91568c520b666898f57cdcb8cf6 · Patch
• https://osv.dev/vulnerability/CVE-2026-23238 · Vendor Advisory
• https://git.kernel.org/stable/c/4b71ad7676564a94ec5f7d18298f51e8ae53db73 · Patch
• https://git.kernel.org/stable/c/9b203b8ddd7359270e8a694d0584743555128e2c · Patch