CVE-2026-53029

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: prevent uninitialized lcn caused by zero len

syzbot reported a uninit-value in ntfs_iomap_begin [1].

Since runs was not touched yet, run_lookup_entry() immediately fails

and returns false, which makes the value of "*len" 0.

Simultaneously, the new value and err value are also 0, causing the

logic in attr_data_get_block_locked() to jump directly to ok, ultimately

resulting in *lcn being triggered before it is set [1].

In ntfs_iomap_begin(), the check for a 0 value in clen is moved forward

to before updating lcn to avoid this [1].

[1]

BUG: KMSAN: uninit-value in ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825

ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825

iomap_iter+0x9b7/0x1540 fs/iomap/iter.c:110

Local variable lcn created at:

ntfs_iomap_begin+0x15d/0x1460 fs/ntfs3/inode.c:786

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References