CVE-2026-53027 (GCVE-0-2026-53027)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:29 – Updated: 2026-07-24 14:33
VLAI
Title
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < ea59d9dbc5504e29d420ac4aab774cbce39b0e69 (git)
Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < d68a14450783ecc5fddae957ac4e1c546dfcfb73 (git)
Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < 08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147 (git)
Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < 2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54 (git)
Affected: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b , < d7ea8495fd307b58f8867acd81a1b40075b1d3ba (git)
Affected: 406a037d93b769bca248476bd14bbe548dc1ec35 (git)
Affected: 6.1.132 , < 6.2 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea59d9dbc5504e29d420ac4aab774cbce39b0e69",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "d68a14450783ecc5fddae957ac4e1c546dfcfb73",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "d7ea8495fd307b58f8867acd81a1b40075b1d3ba",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "406a037d93b769bca248476bd14bbe548dc1ec35",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.132",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.132",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()\n\nWhen a compressed or sparse attribute has its clusters frame-aligned,\nvcn is rounded down to the frame start using cmask, which can result\nin vcn != vcn0. In this case, vcn and vcn0 may reside in different\nattribute segments.\n\nThe code already handles the case where vcn is in a different segment\nby loading its runs before allocation. However, it fails to load runs\nfor vcn0 when vcn0 resides in a different segment than vcn. This causes\nrun_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was\nnever loaded into the in-memory run list, triggering the WARN_ON(1).\n\nFix this by adding a missing check for vcn0 after the existing vcn\nsegment check. If vcn0 falls outside the current segment range\n[svcn, evcn1), find and load the attribute segment containing vcn0\nbefore performing the run lookup.\n\nThe following scenario triggers the bug:\n  attr_data_get_block_locked()\n    vcn = vcn0 \u0026 cmask        \u003c- vcn != vcn0 after frame alignment\n    load runs for vcn segment \u003c- vcn0 segment not loaded!\n    attr_allocate_clusters()  \u003c- allocation succeeds\n    run_lookup_entry(vcn0)    \u003c- vcn0 not in run -\u003e SPARSE_LCN\n    WARN_ON(1)                \u003c- bug fires here!"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:47.674Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69"
        },
        {
          "url": "https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba"
        }
      ],
      "title": "fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53027",
    "datePublished": "2026-06-24T16:29:35.740Z",
    "dateReserved": "2026-06-09T07:44:35.379Z",
    "dateUpdated": "2026-07-24T14:33:47.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53027",
      "date": "2026-09-21",
      "epss": "0.00122",
      "percentile": "0.02281"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:13:47.000Z",
      "cve": "CVE-2026-53027",
      "id": "msrc_CVE-2026-53027",
      "initial_release_date": "2026-06-27T01:05:42.000Z",
      "product_status:known_affected": "3",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53027.json",
      "version": "6"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/attrib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ea59d9dbc5504e29d420ac4aab774cbce39b0e69",
                    "status": "affected",
                    "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d68a14450783ecc5fddae957ac4e1c546dfcfb73",
                    "status": "affected",
                    "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147",
                    "status": "affected",
                    "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54",
                    "status": "affected",
                    "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d7ea8495fd307b58f8867acd81a1b40075b1d3ba",
                    "status": "affected",
                    "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "406a037d93b769bca248476bd14bbe548dc1ec35",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.132",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ntfs3/attrib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8480507E-6181-45AC-88A3-8D7117A658F4",
                    "versionEndExcluding": "6.2",
                    "versionStartIncluding": "6.1.132",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5F8F4699-C05C-4ED7-8D26-696EEB5FFB09",
                    "versionEndExcluding": "7.0.10",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()\n\nWhen a compressed or sparse attribute has its clusters frame-aligned,\nvcn is rounded down to the frame start using cmask, which can result\nin vcn != vcn0. In this case, vcn and vcn0 may reside in different\nattribute segments.\n\nThe code already handles the case where vcn is in a different segment\nby loading its runs before allocation. However, it fails to load runs\nfor vcn0 when vcn0 resides in a different segment than vcn. This causes\nrun_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was\nnever loaded into the in-memory run list, triggering the WARN_ON(1).\n\nFix this by adding a missing check for vcn0 after the existing vcn\nsegment check. If vcn0 falls outside the current segment range\n[svcn, evcn1), find and load the attribute segment containing vcn0\nbefore performing the run lookup.\n\nThe following scenario triggers the bug:\n  attr_data_get_block_locked()\n    vcn = vcn0 \u0026 cmask        \u003c- vcn != vcn0 after frame alignment\n    load runs for vcn segment \u003c- vcn0 segment not loaded!\n    attr_allocate_clusters()  \u003c- allocation succeeds\n    run_lookup_entry(vcn0)    \u003c- vcn0 not in run -\u003e SPARSE_LCN\n    WARN_ON(1)                \u003c- bug fires here!"
          }
        ],
        "id": "CVE-2026-53027",
        "lastModified": "2026-07-24T15:18:00.020",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-06-24T17:17:14.087",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:22:55+00:00",
      "cve": "CVE-2026-53027",
      "id": "CVE-2026-53027",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53027.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:36:54Z",
      "cve": "CVE-2026-53027",
      "id": "CVE-2026-53027",
      "initial_release_date": "2026-06-27T01:54:50Z",
      "product_status:known_affected": "17",
      "product_status:known_not_affected": "276",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53027",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53027.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.