Skip to main content

Linux Kernel NTFS3 EUVDEUVD-2026-38895

| CVE-2026-53027 MEDIUM
2026-06-24 Linux GHSA-mcqq-386f-gvf4
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privileges required to mount and access an NTFS volume; no confidentiality or integrity impact; availability impact via kernel WARN_ON is high.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 15, 2026 - 17:01 vuln.today
CVSS changed
Jul 15, 2026 - 14:52 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()

When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments.

The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1).

Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup.

The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN WARN_ON(1) <- bug fires here!

AnalysisAI

Kernel availability impact in the Linux NTFS3 filesystem driver allows a local low-privileged user to trigger a WARN_ON(1) in attr_data_get_block_locked() by accessing NTFS volumes containing compressed or sparse attributes with frame-aligned cluster boundaries. The root cause is a missing run-segment load for vcn0 when it resides in a different attribute segment than vcn after cmask rounding, causing run_lookup_entry() to return SPARSE_LCN and fire the kernel warning. No public exploit has been identified and EPSS is 0.15% (5th percentile), confirming this as a low-probability exploitation target despite the confirmed vendor patch.

Technical ContextAI

The vulnerability is located in fs/ntfs3/attrib.c within the attr_data_get_block_locked() function of the Linux kernel's modern in-tree NTFS3 driver. NTFS3 supports compressed and sparse file attributes, which use a run list (a mapping of virtual cluster numbers, VCNs, to logical cluster numbers, LCNs) that may be split across multiple on-disk attribute segments. When an attribute's VCN is rounded down to a compression frame boundary using a compression mask (cmask), the resulting vcn0 can differ from vcn and may belong to a different, unloaded attribute segment. The existing code correctly loads runs for the vcn segment but omits an analogous check for vcn0, leaving its segment absent from the in-memory run list. When run_lookup_entry() is subsequently called for vcn0, it finds no entry and returns SPARSE_LCN, which is only valid for truly sparse clusters - triggering WARN_ON(1). CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the full kernel tree; no specific CWE has been assigned, but this is a logic/missing-check error in run-list segment management for compressed or sparse NTFS attribute blocks.

RemediationAI

The primary remediation is upgrading to a patched kernel version: Linux 7.0.10 or 7.1 per EUVD-2026-38895, incorporating fix commits 2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54 and d7ea8495fd307b58f8867acd81a1b40075b1d3ba (https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54 and https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba). Distribution-specific kernel updates from Debian, Ubuntu, RHEL, or SUSE should be applied as soon as they incorporate these commits. Where an immediate kernel upgrade is not feasible, a practical workaround is blacklisting the ntfs3 kernel module (add 'blacklist ntfs3' to /etc/modprobe.d/) to prevent it from loading; this eliminates the attack surface entirely but also removes native NTFS3 read-write support - systems requiring NTFS access can substitute the userspace ntfs-3g driver as a lower-risk alternative. Systems that do not mount NTFS volumes require no compensating controls since the vulnerable code path is unreachable.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38895 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy