CVE-2026-53029: Linux NTFS3 Kernel Uninitialized Variable Denial of Service

Technical summary

CVE-2026-53029 is a use-of-uninitialized-variable vulnerability in fs/ntfs3/inode.c within the Linux kernel's NTFS3 filesystem implementation. The vulnerability arises in the ntfs_iomap_begin() function during the iomap iteration process. When run_lookup_entry() returns false due to an uninitialized runs structure, both the length parameter (clen) and err value become zero. This causes the attr_data_get_block_locked() function to bypass normal control flow and jump to the success path without properly initializing the lcn (logical cluster number) variable. The lcn variable is subsequently read before assignment, exposing uninitialized kernel stack memory. The fix moves the zero-length check in ntfs_iomap_begin() earlier in the execution flow, before the lcn variable is updated, preventing the use of uninitialized data.

Business impact

Systems running vulnerable Linux kernels with NTFS3 filesystem support face potential denial of service. Any local user with filesystem access can crash the kernel by triggering the uninitialized variable condition, resulting in system downtime and service interruption. This is particularly impactful for multi-tenant systems, containerized environments, or shared hosting platforms where NTFS3 is enabled. While the vulnerability does not enable privilege escalation or data theft, the stability impact is significant for availability-dependent workloads.

Affected systems

Linux kernel versions supporting the NTFS3 filesystem driver are affected. The NTFS3 driver is typically enabled in general-purpose Linux distributions as an optional module or built-in component, particularly for systems requiring NTFS partition compatibility. Systems that do not mount or interact with NTFS3 filesystems are not at practical risk. Check your kernel configuration (CONFIG_NTFS3) and mounted filesystem types to determine exposure.

Exploitability

Exploitation requires local access to the system and the ability to perform filesystem operations on an NTFS3-mounted volume. The barrier to triggering is relatively low—no special privileges beyond standard user file access are needed, and no advanced techniques are required. The vulnerability is triggered through normal filesystem read/write operations on specially crafted file states, making it accessible to any local user. Remote exploitation is not possible; the attack surface is limited to local users with filesystem access.

Remediation

Apply the Linux kernel patch that moves the zero-length check (clen == 0) in ntfs_iomap_begin() to occur before lcn is updated. This prevents the function from proceeding with uninitialized lcn values. Monitor your kernel version and security advisories from your distribution for patched kernel releases. Systems that do not use NTFS3 (confirm via mount output and kernel configuration) are unaffected and require no action.

Patch guidance

Obtain and install the patched Linux kernel version from your distribution's security updates. Verify the kernel changelog includes the NTFS3 fix that moves the clen zero-check earlier in ntfs_iomap_begin(). For rolling-release distributions, update to the latest kernel package. For fixed-release distributions, wait for the security update advisory and apply when available. Testing the patch on a non-production system is recommended, particularly if NTFS3 is heavily used. Verify that NTFS3 filesystems continue to mount and function correctly after patching.

Detection guidance

Monitor system logs for kernel panic or oops messages referencing ntfs_iomap_begin() or the NTFS3 driver. Look for kernel address sanitizer (KMSAN) or undefined behavior (UBsan) warnings if your system has those sanitizers enabled. Check for sudden system reboots or crashes correlated with NTFS3 filesystem access. Tools like `journalctl` (systemd systems) or `/var/log/kern.log` will capture kernel crash details. Confirm kernel version running: `uname -r` and verify if NTFS3 is loaded: `lsmod | grep ntfs3`.

Why prioritize this

This medium-severity vulnerability should be prioritized for patching on systems that both run Linux kernels with NTFS3 enabled and have untrusted local users or multi-tenant workloads. For single-user or restricted-access systems, or systems not using NTFS3 filesystems, prioritization can be lower. The availability impact and local-attack requirement make this a moderate but manageable risk. Organizations should patch within standard monthly security update cycles unless they operate high-availability systems where kernel stability is critical, in which case expedited patching is warranted.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local-attack-only vulnerability (AV:L) requiring low privileges (PR:L) and producing a denial-of-service impact (A:H). No confidentiality or integrity impact is possible. The score appropriately captures the availability risk balanced against the requirement for local access. Organizations should not dismiss this as low-risk; denial of service impacts can be severe depending on system role and availability requirements.

Frequently asked questions