CVE-2026-23388 Squashfs: check metadata block offset is within range