CVE-2026-53027
Description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
When a compressed or sparse attribute has its clusters frame-aligned,
vcn is rounded down to the frame start using cmask, which can result
in vcn != vcn0. In this case, vcn and vcn0 may reside in different
attribute segments.
The code already handles the case where vcn is in a different segment
by loading its runs before allocation. However, it fails to load runs
for vcn0 when vcn0 resides in a different segment than vcn. This causes
run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was
never loaded into the in-memory run list, triggering the WARN_ON(1).
Fix this by adding a missing check for vcn0 after the existing vcn
segment check. If vcn0 falls outside the current segment range
[svcn, evcn1), find and load the attribute segment containing vcn0
before performing the run lookup.
The following scenario triggers the bug:
attr_data_get_block_locked()
vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment
load runs for vcn segment <- vcn0 segment not loaded!
attr_allocate_clusters() <- allocation succeeds
run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN
WARN_ON(1) <- bug fires here!
Summary dbcve.org
A race condition in the Linux kernel's NTFS3 filesystem driver causes a missing run load for vcn0 when compressed or sparse attributes have frame-aligned clusters. When vcn is rounded down to the frame start using cmask, vcn != vcn0 and they may reside in different attribute segments. The code loads runs for the vcn segment but fails to load runs for vcn0 when it's in a different segment, causing run_lookup_entry() to return SPARSE_LCN for vcn0 and triggering a WARN_ON(1) kernel bug.
Mitigation
Apply the kernel patch to add the missing check for vcn0 segment loading after the existing vcn segment check in attr_data_get_block_locked(). This is a kernel-level fix requiring kernel source code modification and recompilation.