CVE-2026-23238: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23238 is a Linux kernel vulnerability in the romfs filesystem driver where romfs_fill_super() fails to check the return value of sb_set_blocksize(), leading to a kernel panic (denial of service). The flaw affects Linux kernel versions from 2.6.12.1 through multiple stable branches, with specific vulnerable ranges including 5.10.x prior to 5.10.251, 5.11–5.15.x prior to 5.15.201, 5.16–6.1.x prior to 6.1.164, 6.2–6.6.x prior to 6.6.127, 6.7–6.12.x prior to 6.12.74, and 6.13–6.18.x prior to 6.18.13. It was published on March 4, 2026, with patches released March 17, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as CWE-617 (Reachable Assertion): romfs_fill_super() ignores the return value of sb_set_blocksize(), which returns 0 on failure when the requested block size is incompatible with the block device's logical block size. An attacker with local access can trigger this by using ioctl(LOOP_SET_BLOCK_SIZE, 32768) to configure a loop device with a block size larger than PAGE_SIZE, then mounting a romfs filesystem on that device. When sb_set_blocksize(sb, ROMBSIZE=4096) fails silently against a device with logical_block_size=32768, the superblock retains the incompatible block size; subsequent sb_bread() I/O triggers a BUG_ON(size > PAGE_SIZE) assertion at fs/buffer.c:1582 in folio_set_bh(), causing a kernel panic. The fix adds a return value check and fails the mount with -EINVAL if sb_set_blocksize() returns 0 (Feedly).

Successful exploitation results in a kernel panic and denial of service, crashing the affected system. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. A local user with low privileges can reliably crash the kernel by manipulating loop device configuration and mounting a romfs filesystem, making this a practical local DoS vector on any system where users can access loop devices and mount filesystems (Feedly).

1. Gain local access: Obtain a local shell on a target system running a vulnerable Linux kernel version with access to loop devices and filesystem mounting capabilities.
2. Create a loop device with oversized block size: Use ioctl(LOOP_SET_BLOCK_SIZE, 32768) to configure a loop device (e.g., /dev/loop0) with a logical block size of 32768 bytes, which exceeds PAGE_SIZE (typically 4096 bytes).
3. Prepare a romfs image: Create or obtain a valid romfs filesystem image (e.g., using genromfs) and associate it with the configured loop device via losetup.
4. Mount the romfs filesystem: Execute mount -t romfs /dev/loop0 /mnt/target. This triggers romfs_fill_super(), which calls sb_set_blocksize(sb, 4096) — this call fails silently because 4096 < 32768 (the device's logical block size).
5. Trigger kernel panic: The mount proceeds with the incompatible block size; when sb_bread() attempts I/O, it hits BUG_ON(size > PAGE_SIZE) at fs/buffer.c:1582, causing an immediate kernel panic and system crash (Feedly).

• Logs: Kernel crash logs or dmesg output containing kernel BUG at fs/buffer.c:1582! and BUG_ON(size > PAGE_SIZE) immediately following a romfs mount attempt.
• Logs: System logs showing mount -t romfs commands combined with prior ioctl LOOP_SET_BLOCK_SIZE calls with values ≥ 8192 or 32768.
• Process: Unusual use of losetup or loop device configuration utilities by non-root users, particularly setting block sizes larger than the system page size.
• File System: Unexpected romfs mount attempts on loop devices with non-standard block size configurations in /proc/mounts or audit logs prior to a system crash.

Apply the upstream kernel patches released on March 17, 2026, targeting the following fixed versions: 5.10.251, 5.15.201, 6.1.164, 6.6.127, 6.12.74, 6.18.13, and 6.19. Patch commits are available across multiple stable branches (e.g., 2c5829cd, 4b71ad76, 9b203b8d, a381f0f6, ab7ad7ab, cbd9931e, f2521ab1). As a workaround where patching is not immediately possible, restrict local user access to loop device ioctl commands and limit the ability to mount arbitrary filesystems (e.g., via mount namespace restrictions or removing CAP_SYS_ADMIN from unprivileged users). Debian has issued DSA-6163-1 and DLA-4499-1 advisories, and Amazon Linux 2 has released ALAS2KERNEL-5.10-2026-114 (Feedly, Microsoft MSRC, Debian LTS).

The vulnerability was included in coverage of Microsoft's March 2026 Patch Tuesday, which addressed 79 flaws including 2 zero-days, with CVE-2026-23238 noted as part of the Linux kernel component tracked by Microsoft for CBL-Mariner/Azure Linux (BleepingComputer). Debian issued security advisories (DSA-6163-1 and DLA-4499-1) covering this CVE among other kernel fixes, and Amazon Linux also released a corresponding advisory. No significant independent researcher commentary or social media discussion specific to this vulnerability has been identified beyond standard vulnerability tracking.