CVE-2026-72471

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: prevent potential lcn remains uninitialized

The target VCN being sought was not found within runs[0], causing runlookup() to return false. This causes runlookupentry() to return false, which in turn results in a len value of 0, and the new parameter passed to attrdatagetblock() is NULL. Collectively, these factors ultimately cause attrdatagetblocklocked() to exit prematurely without initializing lcn, thereby triggering [1].

To prevent [1], the clen check within niseekdataorhole() has been moved to occur before the lcn check.

[1] BUG: KMSAN: uninit-value in niseekdataorhole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862 niseekdataorhole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862 ntfsllseek+0x22a/0x4a0 fs/ntfs3/file.c:1530 vfsllseek fs/read_write.c:391 [inline]