UnratedFix available

fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!

Products: Kernel
Affected versions: Not specified
Fixed versions: 6.1.191, 6.12.96, 6.18.39, 6.6.145, 7.0.10
CVEs: CVE-2026-53027
Confirmed fixed CVEs: Not specified
Updated in this feed: 2 Nov 2026, 15:28 UTC · Revision 1

Source evidence

fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

core-osv · Original source

Published 24 Jun 2026, 16:29 UTC

osv:CVE-2026-53027

Kernel

Fixed versions: 6.1.191, 6.6.145, 6.12.96, 6.18.39, 7.0.10

Complete source record

{
  "id": "2b961a548ec6f23b0a5f56f6e3aa7aff878b0a718686dbdef232af80a03e64b8",
  "url": "https://osv.dev/vulnerability/CVE-2026-53027",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!",
    "evidence": "osv:CVE-2026-53027",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.191",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.145",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.96",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.39",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.0.10",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-53027",
      "aliases": [
        "CVE-2026-53027"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "406a037d93b769bca248476bd14bbe548dc1ec35"
                },
                {
                  "fixed": "543093f65318d012850e548b241f85381b14d643"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b"
                },
                {
                  "fixed": "ea59d9dbc5504e29d420ac4aab774cbce39b0e69"
                },
                {
                  "fixed": "d68a14450783ecc5fddae957ac4e1c546dfcfb73"
                },
                {
                  "fixed": "08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147"
                },
                {
                  "fixed": "2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54"
                },
                {
                  "fixed": "d7ea8495fd307b58f8867acd81a1b40075b1d3ba"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.1.132"
                },
                {
                  "fixed": "6.1.191"
                }
              ]
            }
          ],
          "versions": [
            "v6.1.190",
            "v6.1.189",
            "v6.1.188",
            "v6.1.187",
            "v6.1.186",
            "v6.1.185",
            "v6.1.184",
            "v6.1.183",
            "v6.1.182",
            "v6.1.181",
            "v6.1.180",
            "v6.1.179",
            "v6.1.178",
            "v6.1.177",
            "v6.1.176",
            "v6.1.175",
            "v6.1.174",
            "v6.1.173",
            "v6.1.172",
            "v6.1.171",
            "v6.1.170",
            "v6.1.169",
            "v6.1.168",
            "v6.1.167",
            "v6.1.166",
            "v6.1.165",
            "v6.1.164",
            "v6.1.163",
            "v6.1.162",
            "v6.1.161",
            "v6.1.160",
            "v6.1.159",
            "v6.1.158",
            "v6.1.157",
            "v6.1.156",
            "v6.1.155",
            "v6.1.154",
            "v6.1.153",
            "v6.1.152",
            "v6.1.151",
            "v6.1.150",
            "v6.1.149",
            "v6.1.148",
            "v6.1.147",
            "v6.1.146",
            "v6.1.145",
            "v6.1.144",
            "v6.1.143",
            "v6.1.142",
            "v6.1.141",
            "v6.1.140",
            "v6.1.139",
            "v6.1.138",
            "v6.1.137",
            "v6.1.136",
            "v6.1.135",
            "v6.1.134",
            "v6.1.133",
            "v6.1.132"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53027.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.1.191"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.145"
                },
                {
                  "fixed": "6.12.96"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.18.39"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "7.0.10"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53027.json"
          }
        }
      ],
      "modified": "2026-11-01T02:30:43.054007969Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147",
        "https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54",
        "https://git.kernel.org/stable/c/543093f65318d012850e548b241f85381b14d643",
        "https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73",
        "https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba",
        "https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53027.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-53027",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53027.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-53027",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 486518,
  "published_at": "2026-06-24T16:29:35.74+00:00"
}