CVE-2026-53027
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 18, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Load vcn0 segment if outside current range.
- Update the Linux kernel.
- Apply patches to the NTFS3 driver.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53027.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53027 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53027
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53027 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53027 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 18, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147 Added Reference https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': '2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54', 'versionType': 'git'}, {'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': 'd7ea8495fd307b58f8867acd81a1b40075b1d3ba', 'versionType': 'git'}, {'status': 'affected', 'version': '406a037d93b769bca248476bd14bbe548dc1ec35', 'versionType': 'git'}, {'status': 'affected', 'version': '6.1.132', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/ntfs3/attrib.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ntfs3/attrib.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': 'd68a14450783ecc5fddae957ac4e1c546dfcfb73', 'versionType': 'git'}, {'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': '08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147', 'versionType': 'git'}, {'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': '2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54', 'versionType': 'git'}, {'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': 'd7ea8495fd307b58f8867acd81a1b40075b1d3ba', 'versionType': 'git'}, {'status': 'affected', 'version': '406a037d93b769bca248476bd14bbe548dc1ec35', 'versionType': 'git'}, {'status': 'affected', 'version': '6.1.132', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/ntfs3/attrib.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.96', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.39', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ntfs3/attrib.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jul. 15, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.132 up to (excluding) 6.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 7.0.10 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': '2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54', 'versionType': 'git'}, {'status': 'affected', 'version': 'c380b52f6c5702cc4bdda5e6d456d6c19a201a0b', 'lessThan': 'd7ea8495fd307b58f8867acd81a1b40075b1d3ba', 'versionType': 'git'}, {'status': 'affected', 'version': '406a037d93b769bca248476bd14bbe548dc1ec35', 'versionType': 'git'}, {'status': 'affected', 'version': '6.1.132', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/ntfs3/attrib.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ntfs3/attrib.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here! Added Reference https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54 Added Reference https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba