Skip to main content

Linux Kernel EUVDEUVD-2026-38897

| CVE-2026-53029 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-06-24 Linux GHSA-hw8w-qhg7-g497
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger via ntfs3 driver I/O, low-privilege user sufficient, no confidentiality or integrity impact confirmed.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 15, 2026 - 17:01 vuln.today
CVSS changed
Jul 15, 2026 - 14:52 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: prevent uninitialized lcn caused by zero len

syzbot reported a uninit-value in ntfs_iomap_begin [1].

Since runs was not touched yet, run_lookup_entry() immediately fails and returns false, which makes the value of "*len" 0. Simultaneously, the new value and err value are also 0, causing the logic in attr_data_get_block_locked() to jump directly to ok, ultimately resulting in *lcn being triggered before it is set [1].

In ntfs_iomap_begin(), the check for a 0 value in clen is moved forward to before updating lcn to avoid this [1].

[1] BUG: KMSAN: uninit-value in ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825 ntfs_iomap_begin+0x8c0/0x1460 fs/ntfs3/inode.c:825 iomap_iter+0x9b7/0x1540 fs/iomap/iter.c:110

Local variable lcn created at: ntfs_iomap_begin+0x15d/0x1460 fs/ntfs3/inode.c:786

AnalysisAI

Uninitialized variable read in the NTFS3 filesystem driver (ntfs_iomap_begin()) of the Linux kernel allows a local authenticated user to crash the system by triggering a zero-length run condition that causes the lcn (logical cluster number) variable to be consumed before assignment. The flaw affects Linux 7.0 up to 7.0.10 and Linux 7.1 prior to the stable fix commits, with the defect discovered and confirmed by Google syzbot via KMSAN. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile); patches are available in Linux 7.0.10 and 7.1.

Technical ContextAI

The vulnerability resides in fs/ntfs3/inode.c at line 825 within ntfs_iomap_begin(), which implements the Linux iomap extent-mapping interface for the in-kernel NTFS3 driver. The root cause is CWE-908 (Use of Uninitialized Resource): the local variable lcn (logical cluster number, used to resolve file extents to on-disk block addresses) is declared without initialization. When run_lookup_entry() fails because the run list has not been populated, it returns false and leaves *len set to zero. Because both the derived block value and the error code simultaneously evaluate to zero, the function's control flow bypasses the conditional branch that would assign lcn and falls through directly to the ok label, where lcn is read while still containing indeterminate stack data. The fix, applied in commits 485f750cac3d8bdf5552a0e3d79ce5e3a03ece49 and e98266e823a1fa06fe6499df61aeaac2fd6f7a49, moves the clen == 0 guard earlier in the function to abort before the uninitialized read can occur. The bug was surfaced by Google's syzbot kernel fuzzing infrastructure using KMSAN, the Kernel Memory Sanitizer.

RemediationAI

The primary remediation is upgrading to Linux 7.0.10 or applying the Linux 7.1 patch commit e98266e823a1fa06fe6499df61aeaac2fd6f7a49, both referenced at https://git.kernel.org/stable/c/485f750cac3d8bdf5552a0e3d79ce5e3a03ece49 and https://git.kernel.org/stable/c/e98266e823a1fa06fe6499df61aeaac2fd6f7a49. Where immediate patching is not feasible, disabling the ntfs3 kernel module via the boot parameter modprobe.blacklist=ntfs3 or by removing the module with rmmod ntfs3 effectively eliminates the attack surface; the trade-off is that NTFS volumes can no longer be mounted using the in-kernel driver (the userspace ntfs-3g FUSE driver remains available as a functional alternative with no known equivalent flaw). Organizations that do not mount NTFS volumes in their environments have no exposure and require no action beyond standard patch cadence.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38897 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy