CVE-2026-53027

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()<br /> <br /> When a compressed or sparse attribute has its clusters frame-aligned,<br /> vcn is rounded down to the frame start using cmask, which can result<br /> in vcn != vcn0. In this case, vcn and vcn0 may reside in different<br /> attribute segments.<br /> <br /> The code already handles the case where vcn is in a different segment<br /> by loading its runs before allocation. However, it fails to load runs<br /> for vcn0 when vcn0 resides in a different segment than vcn. This causes<br /> run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was<br /> never loaded into the in-memory run list, triggering the WARN_ON(1).<br /> <br /> Fix this by adding a missing check for vcn0 after the existing vcn<br /> segment check. If vcn0 falls outside the current segment range<br /> [svcn, evcn1), find and load the attribute segment containing vcn0<br /> before performing the run lookup.<br /> <br /> The following scenario triggers the bug:<br /> attr_data_get_block_locked()<br /> vcn = vcn0 &amp; cmask