Junglewise Threat Intelligence

CVE-2026-23238: Linux Kernel reachable assertion in romfs_fill_super

CVE-2026-23238 · Severity: medium · CVSS 5.5 · Published 2026-03-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's romfs file system driver could allow a local user to crash the system. By mounting a specially configured storage device, an attacker can trigger a kernel error that leads to a complete system halt (denial of service). This affects systems using the romfs file system, typically found in embedded or specialized environments.

Technical details

A reachable assertion (CWE-617) exists in the romfs file system implementation within the Linux kernel. The function romfs_fill_super() ignores the return value of sb_set_blocksize(), which can fail if the requested block size (ROMBSIZE, 4096) is smaller than the device's logical block size. If a local attacker configures a loop device with a block size larger than PAGE_SIZE (e.g., 32768) and mounts a romfs filesystem on it, subsequent I/O operations via sb_bread() trigger a BUG_ON(size > PAGE_SIZE) in fs/buffer.c. This results in a kernel panic and denial of service. Patches have been released across multiple stable kernel branches to check the return value and fail the mount operation with -EINVAL.

Affected products

  • Linux Linux Kernel 2.6.12.1 to 5.10.251, 5.11 to 5.15.201, 5.16 to 6.1.164, 6.2 to 6.6.127, 6.7 to 6.12.74, 6.13 to 6.18.13

Timeline

  • 2026-03-04: advisory: CVE-2026-23238 published by NVD
  • 2026-02-19: patched: Fix committed to stable kernel trees

References

Related threats