CVE-2026-72471

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: prevent potential lcn remains uninitialized

The target VCN being sought was not found within runs[0], causing

run_lookup() to return false. This causes run_lookup_entry() to return

false, which in turn results in a len value of 0, and the new parameter

passed to attr_data_get_block() is NULL. Collectively, these factors

ultimately cause attr_data_get_block_locked() to exit prematurely without

initializing lcn, thereby triggering [1].

To prevent [1], the clen check within ni_seek_data_or_hole() has been

moved to occur before the lcn check.

[1]

BUG: KMSAN: uninit-value in ni_seek_data_or_hole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862

ni_seek_data_or_hole+0x24f/0x5f0 fs/ntfs3/frecord.c:2862

ntfs_llseek+0x22a/0x4a0 fs/ntfs3/file.c:1530

vfs_llseek fs/read_write.c:391 [inline]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References