CVE-2026-23238

In the Linux kernel, the following vulnerability has been resolved:

romfs: check sb_set_blocksize() return value

romfs_fill_super() ignores the return value of sb_set_blocksize(), which

can fail if the requested block size is incompatible with the block

device's configuration.

This can be triggered by setting a loop device's block size larger than

PAGE_SIZE using ioctl(LOOP_SET_BLOCK_SIZE, 32768), then mounting a romfs

filesystem on that device.

When sb_set_blocksize(sb, ROMBSIZE) is called with ROMBSIZE=4096 but the

device has logical_block_size=32768, bdev_validate_blocksize() fails

because the requested size is smaller than the device's logical block

size. sb_set_blocksize() returns 0 (failure), but romfs ignores this and

continues mounting.

The superblock's block size remains at the device's logical block size

(32768). Later, when sb_bread() attempts I/O with this oversized block

size, it triggers a kernel BUG in folio_set_bh():

kernel BUG at fs/buffer.c:1582!

BUG_ON(size > PAGE_SIZE);

Fix by checking the return value of sb_set_blocksize() and failing the

mount with -EINVAL if it returns 0.