UBUNTU-CVE-2026-53027
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
4 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
24 explicit affected versions
2 explicit affected versions
10 explicit affected versions
39 explicit affected versions
26 explicit affected versions
7 explicit affected versions
42 explicit affected versions
13 explicit affected versions
46 explicit affected versions
35 explicit affected versions
1 explicit affected versions
18 explicit affected versions
1 explicit affected versions
48 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
55 explicit affected versions
1 explicit affected versions
21 explicit affected versions
9 explicit affected versions
16 explicit affected versions
10 explicit affected versions
20 explicit affected versions
7 explicit affected versions
51 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
19 explicit affected versions
12 explicit affected versions
10 explicit affected versions
12 explicit affected versions
44 explicit affected versions
9 explicit affected versions
9 explicit affected versions
16 explicit affected versions
6 explicit affected versions
17 explicit affected versions
29 explicit affected versions
37 explicit affected versions
10 explicit affected versions
37 explicit affected versions
10 explicit affected versions
11 explicit affected versions
13 explicit affected versions
42 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
26 explicit affected versions
12 explicit affected versions
13 explicit affected versions
29 explicit affected versions
13 explicit affected versions
12 explicit affected versions
43 explicit affected versions
43 explicit affected versions
8 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
23 explicit affected versions
22 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
10 explicit affected versions
16 explicit affected versions
17 explicit affected versions
5 explicit affected versions
10 explicit affected versions
26 explicit affected versions
42 explicit affected versions
37 explicit affected versions
48 explicit affected versions
11 explicit affected versions
10 explicit affected versions
13 explicit affected versions
48 explicit affected versions
16 explicit affected versions
53 explicit affected versions
10 explicit affected versions
3 explicit affected versions
7 explicit affected versions
15 explicit affected versions
51 explicit affected versions
16 explicit affected versions
18 explicit affected versions
43 explicit affected versions
12 explicit affected versions
7 explicit affected versions
27 explicit affected versions
3 explicit affected versions
8 explicit affected versions
45 explicit affected versions
8 explicit affected versions
3 explicit affected versions
5 explicit affected versions
8 explicit affected versions
6 explicit affected versions
10 explicit affected versions
7 explicit affected versions
49 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
53 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
17 explicit affected versions
11 explicit affected versions
42 explicit affected versions
21 explicit affected versions
14 explicit affected versions
8 explicit affected versions
7 explicit affected versions
4 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
13 explicit affected versions
43 explicit affected versions
16 explicit affected versions
5 explicit affected versions
10 explicit affected versions
8 explicit affected versions
48 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
14 explicit affected versions
11 explicit affected versions
1 explicit affected versions
22 explicit affected versions
6 explicit affected versions
41 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/d7ea8495fd307b58f8867acd81a1b40075b1d3ba
- https://ubuntu.com/security/CVE-2026-53027
- https://ubuntu.com/security/notices/USN-8566-1
- https://ubuntu.com/security/notices/USN-8568-1
- https://ubuntu.com/security/notices/USN-8569-1
- https://ubuntu.com/security/notices/USN-8593-1
- https://ubuntu.com/security/notices/USN-8603-1
- https://ubuntu.com/security/notices/USN-8618-1
- https://www.cve.org/CVERecord?id=CVE-2026-53027