A logic flaw in the Linux kernel for the qnx4 driver fails to properly validate block sizes that exceed the page size limit. When mounting a file system, this leads to a BUG_ON in folio_set_bh during the first block read, causing the kernel to crash. The direct result is a denial of service that disables the affected system until a reboot or kernel replacement occurs. The likely attack vector is a local privileged user who triggers a mount of a qnx4 file system with an oversized block size.

All Linux kernel installations that have not applied the upstream fix for qnx4 set_blocksize handling are affected. The defect is present in the base Linux kernel before the patch referenced in the advisory sources and applies to any kernel that exposes the qnx4 file system implementation.

The CVSS score of 5.5 indicates a moderate severity vulnerability that can cause a kernel panic when a qnx4 file system with a block size greater than PAGE_SIZE is mounted. The EPSS score of less than 1% suggests a low probability of exploitation, and the flaw is not listed in CISA's KEV catalog. Although the attack requires the ability to trigger a mount operation, usually a privileged user or mount helper, it results in a local denial of service that brings the host offline until a reboot or kernel replacement occurs. Based on the description, it is inferred that the attack vector is a local privileged user invoking the mount operation.