The vulnerability in the Linux kernel NTFS3 driver involved a missing load of run data for vcn0 in the attr_data_get_block_locked() function. When compressed or sparse attributes have clusters frame-aligned, vcn is rounded down to the frame start, which can cause vcn and vcn0 to reside in different attribute segments. While the code handled loading runs for vcn when in a different segment, it failed to do so for vcn0, leading to run_lookup_entry() returning SPARSE_LCN for vcn0 and triggering a kernel warning (WARN_ON(1)). The fix adds a check to load the attribute segment containing vcn0 if it falls outside the current segment range before performing the run lookup. This vulnerability is tracked as CVE-2026-53027 and was fixed in Linux kernel 7.0.0 and later.

This vulnerability causes a kernel warning (WARN_ON(1)) due to improper handling of attribute segments in the NTFS3 filesystem driver. The CVSS score is 5.5 (medium severity) with an impact on availability (A:H) but no confidentiality or integrity impact. There is no indication of known exploits in the wild. The issue could potentially cause system instability or crashes due to the kernel warning.

A patch is available and should be applied by updating to Linux kernel version 7.0.0 or later. The vendor advisory confirms that the issue is fixed in these versions. After updating, a system reboot is required to apply the kernel update. No additional mitigation steps are indicated.