CVE-2026-53029: fs/ntfs3: prevent uninitialized lcn caused by zero len
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: prevent uninitialized lcn caused by zero len
syzbot reported a uninit-value in ntfsiomapbegin [1].
Since runs was not touched yet, runlookupentry() immediately fails and returns false, which makes the value of "len" 0. Simultaneously, the new value and err value are also 0, causing the logic in attrdatagetblocklocked() to jump directly to ok, ultimately resulting in lcn being triggered before it is set [1].
In ntfsiomapbegin(), the check for a 0 value in clen is moved forward to before updating lcn to avoid this [1].
[1] BUG: KMSAN: uninit-value in ntfsiomapbegin+0x8c0/0x1460 fs/ntfs3/inode.c:825 ntfsiomapbegin+0x8c0/0x1460 fs/ntfs3/inode.c:825 iomapiter+0x9b7/0x1540 fs/iomap/iter.c:110
Local variable lcn created at: ntfsiomapbegin+0x15d/0x1460 fs/ntfs3/inode.c:786
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53029?
CVE-2026-53029 has a severity score of 15, indicating it is a critical vulnerability.
How do I fix CVE-2026-53029?
To fix CVE-2026-53029, update your Linux kernel to the latest version where the vulnerability has been patched.
What impact does CVE-2026-53029 have on Linux systems?
CVE-2026-53029 can lead to uninitialized values in the ntfs3 file system, potentially causing system instability.
Which versions of the Linux kernel are affected by CVE-2026-53029?
CVE-2026-53029 affects older versions of the Linux kernel before the patch was applied on June 24, 2026.
Is CVE-2026-53029 actively being exploited?
As of the publication date, there are no known active exploits for CVE-2026-53029, but it is recommended to apply the patch proactively.