CVE-2026-53027

Medium

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!

Package Linux Kernel
Published 2026-06-24
Last modified 2026-07-24
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 6.1.132, 6.2 and later are affected. Fixed in 6.6.145, 6.12.96, 6.18.39, 7.0.10, 7.1 and their respective stable series.

Affected from
≥ 6.1.132 ≥ 6.2
Fixed in
✓ 6.6.145 6.6.x ✓ 6.12.96 6.12.x ✓ 6.18.39 6.18.x ✓ 7.0.10 7.0.x ✓ 7.1

References

5 total

Frequently asked questions

  • What is CVE-2026-53027?

    CVE-2026-53027 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 6.1.132 onward and has been patched in 6.6.145, 6.12.96, 6.18.39 and others. CVE-2026-53027 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-53027?

    CVE-2026-53027 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2026-53027?

    Yes. CVE-2026-53027 has been patched. Fixed versions include 6.6.145, 6.12.96, 6.18.39 and others. If you are running Linux kernel 6.1.132 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-53027 actively exploited?

    No. CVE-2026-53027 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST