In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a… (CVE-2026-53027)
A vulnerability in the Linux kernel's NTFS3 filesystem driver was fixed involving improper handling of run loading for vcn0 in the attr_data_get_block_locked() function. The bug occurs when compressed or sparse attributes have clusters aligned to frame boundaries, causing a mismatch between vcn and vcn0. This leads to missing run loading for vcn0 when it resides in a different attribute segment, triggering a kernel warning and potentially causing allocation inconsistencies. The issue has been resolved by adding a check to load the attribute segment containing vcn0 before run lookup.
AI Analysis
Technical Summary
The Linux kernel NTFS3 driver had a flaw in attr_data_get_block_locked() where, for compressed or sparse attributes with frame-aligned clusters, vcn was rounded down causing vcn != vcn0. While the code loaded runs for the vcn segment, it failed to load runs for vcn0 if it was in a different segment. This omission caused run_lookup_entry() to return SPARSE_LCN for vcn0, triggering a WARN_ON(1) kernel warning. The fix adds a missing check to load the attribute segment for vcn0 before run lookup, preventing this inconsistent state.
Potential Impact
The vulnerability can cause a kernel warning (WARN_ON(1)) due to missing run loading for vcn0, potentially leading to instability or denial of service (kernel crash or hang). There is no indication of confidentiality or integrity impact. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, resulting in no confidentiality or integrity impact but high availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel releases and apply updates when available to ensure the fix is applied. No other mitigations are specified.
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a… (CVE-2026-53027)
Description
A vulnerability in the Linux kernel's NTFS3 filesystem driver was fixed involving improper handling of run loading for vcn0 in the attr_data_get_block_locked() function. The bug occurs when compressed or sparse attributes have clusters aligned to frame boundaries, causing a mismatch between vcn and vcn0. This leads to missing run loading for vcn0 when it resides in a different attribute segment, triggering a kernel warning and potentially causing allocation inconsistencies. The issue has been resolved by adding a check to load the attribute segment containing vcn0 before run lookup.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel NTFS3 driver had a flaw in attr_data_get_block_locked() where, for compressed or sparse attributes with frame-aligned clusters, vcn was rounded down causing vcn != vcn0. While the code loaded runs for the vcn segment, it failed to load runs for vcn0 if it was in a different segment. This omission caused run_lookup_entry() to return SPARSE_LCN for vcn0, triggering a WARN_ON(1) kernel warning. The fix adds a missing check to load the attribute segment for vcn0 before run lookup, preventing this inconsistent state.
Potential Impact
The vulnerability can cause a kernel warning (WARN_ON(1)) due to missing run loading for vcn0, potentially leading to instability or denial of service (kernel crash or hang). There is no indication of confidentiality or integrity impact. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, resulting in no confidentiality or integrity impact but high availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel releases and apply updates when available to ensure the fix is applied. No other mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mcqq-386f-gvf4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53027"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a5bd3172a4a8d5989284cb4
Added to database: 07/18/2026, 19:25:11 UTC
Last enriched: 07/18/2026, 19:25:46 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.