CVE-2026-53029 fs/ntfs3: prevent uninitialized lcn caused by zero len
A local attacker can trigger a kernel crash by exploiting an uninitialized variable in the NTFS3 filesystem driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53029?
CVE-2026-53029 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: prevent uninitialized lcn caused by zero len
syzbot reported a uninit-value in ntfs_iomap_begin [1].
Since runs was not touched yet, run_lookup_entry() immediately fails and returns false, which makes the value of "*len" 0. Simultaneously, the new value and err value are also 0, causing the logic in attr_data_get_block_locked() to jump directly to ok, ultimately resulting in *lcn being triggered before it is set [1].
In ntfs_iomap_begin(), the check for a 0 value in clen is moved forward to before updating lcn to avoid this [1].
[1] BUG: KMSAN: uninit-value in ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825 ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825 iomap_iter+0x9b7/0x1540 fs/iomap/iter.c:110
Local variable lcn created at: ntfs_iomap_begin+0x15d/0x1460 fs/ntfs3/inode.c:786
Weakness: CWE-908
Which versions are affected by CVE-2026-53029?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53029?
Apply the vendor's patch.
Is CVE-2026-53029 being exploited?
There is no known exploitation of CVE-2026-53029 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-53029, GHSA-hw8w-qhg7-g497, UBUNTU-CVE-2026-53029.