Linux Kernel up to 7.0.9 fs attr_data_get_block_locked locking

Summaryinfo

A vulnerability marked as critical has been reported in Linux Kernel up to 7.0.9. This affects the function attr_data_get_block_locked of the component fs. Performing a manipulation results in locking. This vulnerability is cataloged as CVE-2026-53027. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 7.0.9. This affects the function attr_data_get_block_locked of the component fs. The manipulation with an unknown input leads to a locking vulnerability. CWE is classifying the issue as CWE-667. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. This is going to have an impact on availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked() When a compressed or sparse attribute has its clusters frame-aligned, vcn is rounded down to the frame start using cmask, which can result in vcn != vcn0. In this case, vcn and vcn0 may reside in different attribute segments. The code already handles the case where vcn is in a different segment by loading its runs before allocation. However, it fails to load runs for vcn0 when vcn0 resides in a different segment than vcn. This causes run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was never loaded into the in-memory run list, triggering the WARN_ON(1). Fix this by adding a missing check for vcn0 after the existing vcn segment check. If vcn0 falls outside the current segment range [svcn, evcn1), find and load the attribute segment containing vcn0 before performing the run lookup. The following scenario triggers the bug: attr_data_get_block_locked() vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment load runs for vcn segment <- vcn0 segment not loaded! attr_allocate_clusters() <- allocation succeeds run_lookup_entry(vcn0) SPARSE_LCN WARN_ON(1) <- bug fires here!

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-53027 since 06/09/2026. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.0.10 eliminates this vulnerability. Applying the patch 2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54/d7ea8495fd307b58f8867acd81a1b40075b1d3ba is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion