CVE-2026-53027
- Source
- https://cve.org/CVERecord?id=CVE-2026-53027
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53027.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-53027
- Downstream
AZL (1)
BELL (1)
CGA (68)
- CGA-28fh-q4qp-p736
- CGA-2rfp-c595-22rf
- CGA-362w-8p67-5x73
- CGA-3jrh-fxxx-jx3f
- CGA-3pp9-r3c5-g8m8
- CGA-448x-89x6-wggq
- CGA-48w7-vr6f-mf6c
- CGA-4gmx-4jh2-36cp
- CGA-4h7c-64cj-7f2g
- CGA-4jhr-2c5c-v4jj
- CGA-4rcr-535r-w29f
- CGA-54x8-46v5-p6r9
- CGA-598r-qq65-g42r
- CGA-5gc5-qv5c-wvg3
- CGA-7pg9-26wp-xq5h
- CGA-85xm-mrr8-pwhg
- CGA-8w6x-rc56-6f29
- CGA-92qm-423v-h26j
- CGA-95gw-f8gr-2w9j
- CGA-98rh-7q7v-r22c
- CGA-9jmp-v3j2-wmxx
- CGA-9p37-5963-p8qf
- CGA-c259-4vw9-xm29
- CGA-c2m2-3f3v-2jrf
- CGA-cc95-84pw-4hpc
- CGA-cf75-8h9f-mr9c
- CGA-cwg8-mr88-4p34
- CGA-f3q4-3cmh-4hh3
- CGA-ffp2-qh43-jgxp
- CGA-fm3c-f9xr-6h3g
- CGA-fph7-v2hh-qmxc
- CGA-fwjh-5r45-c9vq
- CGA-fx5j-f85c-8hw9
- CGA-g5rx-gm72-qvv2
- CGA-gcrg-px47-2xq2
- CGA-gvgq-9qfq-v6pm
- CGA-gvwx-925w-397p
- CGA-h3qv-x4vj-qxr8
- CGA-hhpr-3m9j-mh43
- CGA-hpgm-9jmq-3m9p
- CGA-hwqr-452r-f4x4
- CGA-j8g3-c8ww-gv4x
- CGA-j8gg-r69w-38rx
- CGA-jvg5-9v4x-4v6g
- CGA-jwr6-37x9-mxq3
- CGA-mfrr-wrm6-hfw8
- CGA-mxgc-x68w-vx8v
- CGA-p39q-fwwh-2g3g
- CGA-q62x-r4mr-wgcc
- CGA-qj75-x2qv-64c6
- CGA-qvmp-5vcm-xpf3
- CGA-qwhj-xp8m-jf99
- CGA-qx82-g96x-97jh
- CGA-r774-g5f8-3vmc
- CGA-rpg8-mhc9-4439
- CGA-rpvr-fm6f-7qrg
- CGA-rw3m-3m2w-h274
- CGA-rw95-r3hj-j7gm
- CGA-vqvm-8qjq-9rvx
- CGA-wcrf-q2pp-q5wr
- CGA-whjj-3qr4-v8f4
- CGA-x4ch-wmmr-6g4f
- CGA-xm9v-gqp7-pj29
- CGA-xmwg-cffj-qv4c
- CGA-xqhq-crwh-fp88
- CGA-xqpc-cjqv-mmph
- CGA-xxh4-hxvj-9qp5
- CGA-xxrw-jjrh-fpj7
DEBIAN (1)
ECHO (1)
ROOT (3)
- Published
- 2026-06-24T16:29:35Z
- Modified
- 2026-10-08T02:51:04Z
- Summary
- fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments.
The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1).
Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup.
The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53027.json" }- References
-
- https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147
- https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54
- https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73
- https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba
- https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53027.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-53027
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc380b52f6c5702cc4bdda5e6d456d6c19a201a0bFixedea59d9dbc5504e29d420ac4aab774cbce39b0e69Fixedd68a14450783ecc5fddae957ac4e1c546dfcfb73Fixed08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147Fixed2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54Fixedd7ea8495fd307b58f8867acd81a1b40075b1d3ba
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.132Fixed6.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced406a037d93b769bca248476bd14bbe548dc1ec35