---
id: CVE-2026-53027
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

  When a compressed or sparse attribute has its clusters frame-aligned,
  vcn is rounded down to th…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

  When a compressed or sparse attribute has its clusters frame-aligned,
  vcn is rounded down to th…
severity: none
published: '2026-06-24'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53027'
references:
  - url: 'https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00162
epssPercentile: 0.04618
ingestedAt: '2026-07-11T19:15:11.971Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

When a compressed or sparse attribute has its clusters frame-aligned,
vcn is rounded down to the frame start using cmask, which can result
in vcn != vcn0. In this case, vcn and vcn0 may reside in different
attribute segments.

The code already handles the case where vcn is in a different segment
by loading its runs before allocation. However, it fails to load runs
for vcn0 when vcn0 resides in a different segment than vcn. This causes
run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was
never loaded into the in-memory run list, triggering the WARN_ON(1).

Fix this by adding a missing check for vcn0 after the existing vcn
segment check. If vcn0 falls outside the current segment range
[svcn, evcn1), find and load the attribute segment containing vcn0
before performing the run lookup.

The following scenario triggers the bug:
  attr_data_get_block_locked()
    vcn = vcn0 & cmask        <- vcn != vcn0 after frame alignment
    load runs for vcn segment <- vcn0 segment not loaded!
    attr_allocate_clusters()  <- allocation succeeds
    run_lookup_entry(vcn0)    <- vcn0 not in run -> SPARSE_LCN
    WARN_ON(1)                <- bug fires here!

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.