PT-2026-51923 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-53029
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: prevent uninitialized lcn caused by zero len
syzbot reported a uninit-value in ntfs iomap begin [1].
Since runs was not touched yet, run lookup entry() immediately fails
and returns false, which makes the value of "*len" 0.
Simultaneously, the new value and err value are also 0, causing the
logic in attr data get block locked() to jump directly to ok, ultimately
resulting in *lcn being triggered before it is set [1].
In ntfs iomap begin(), the check for a 0 value in clen is moved forward
to before updating lcn to avoid this [1].
[1]
BUG: KMSAN: uninit-value in ntfs iomap begin+0x8c0/0x1460 fs/ntfs3/inode.c:825
ntfs iomap begin+0x8c0/0x1460 fs/ntfs3/inode.c:825
iomap iter+0x9b7/0x1540 fs/iomap/iter.c:110
Local variable lcn created at:
ntfs iomap begin+0x15d/0x1460 fs/ntfs3/inode.c:786
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux