Linux Kernel CVE-2026-53029

The vulnerability resides in fs/ntfs3/inode.c at line 825 within ntfs_iomap_begin(), which implements the Linux iomap extent-mapping interface for the in-kernel NTFS3 driver. The root cause is CWE-908 (Use of Uninitialized Resource): the local variable lcn (logical cluster number, used to resolve file extents to on-disk block addresses) is declared without initialization. When run_lookup_entry() fails because the run list has not been populated, it returns false and leaves *len set to zero. Because both the derived block value and the error code simultaneously evaluate to zero, the function's control flow bypasses the conditional branch that would assign lcn and falls through directly to the ok label, where lcn is read while still containing indeterminate stack data. The fix, applied in commits 485f750cac3d8bdf5552a0e3d79ce5e3a03ece49 and e98266e823a1fa06fe6499df61aeaac2fd6f7a49, moves the clen == 0 guard earlier in the function to abort before the uninitialized read can occur. The bug was surfaced by Google's syzbot kernel fuzzing infrastructure using KMSAN, the Kernel Memory Sanitizer.