CVE-2026-53029
Description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: prevent uninitialized lcn caused by zero len
syzbot reported a uninit-value in ntfs_iomap_begin [1].
Since runs was not touched yet, run_lookup_entry() immediately fails
and returns false, which makes the value of "*len" 0.
Simultaneously, the new value and err value are also 0, causing the
logic in attr_data_get_block_locked() to jump directly to ok, ultimately
resulting in *lcn being triggered before it is set [1].
In ntfs_iomap_begin(), the check for a 0 value in clen is moved forward
to before updating lcn to avoid this [1].
[1]
BUG: KMSAN: uninit-value in ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825
ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825
iomap_iter+0x9b7/0x1540 fs/iomap/iter.c:110
Local variable lcn created at:
ntfs_iomap_begin+0x15d/0x1460 fs/ntfs3/inode.c:786
Summary dbcve.org
In the Linux kernel's NTFS3 driver, an uninitialized value bug exists in ntfs_iomap_begin() where the local variable lcn is read before being set. When run_lookup_entry() fails and returns false, *len becomes 0, causing the logic in attr_data_get_block_locked() to bypass proper initialization and jump directly to 'ok', resulting in the uninitialized lcn being used.
Mitigation
Apply the kernel patch that moves the check for clen=0 before lcn is updated to prevent the uninitialized value from being used.