CVE-2026-72471

The NTFS3 driver (merged in kernel 5.15, 2021) contains an uninitialized variable vulnerability in ni_seek_data_or_hole() that can leak an undefined lcn (Logical Cluster Number) value into subsequent filesystem operations. This is not a theoretical bug — the lcn is a disk addressing value that, if it propagates into writeback paths, can cause metadata corruption by directing writes to unintended regions on the volume. The root cause is straightforward: when run_lookup() returns false, the function exits without setting lcn, but callers of ni_seek_data_or_hole() assume lcn is valid on any non-early-exit path. This is a common C kernel pattern error — the assumption that 'no error return implies all outputs are valid.' The fix (moving the clen check earlier) is surgical and correct, but it masks a deeper issue: this exact bug class has appeared in ext4 (CVE-2018-10883), XFS, and Btrfs at similar driver maturity stages. What you should do: First, verify your kernel version. This vulnerability affects NTFS3 driver code merged 2021 through the patch window. Second, enable kernel memory sanitizers (KMSAN) in your build or test environment — this class of bug is precisely what KMSAN catches at runtime, and it likely caught this one before widespread production impact. Third, audit any NTFS3-mounted volumes for integrity if they handled write workloads during the exposure window — the vulnerability's blast radius is larger than a single syscall failure because the lcn feeds into disk addressing that underlies subsequent reads and writes. The NTFS3 driver carries legacy NTFS complexity (extent runs, VCN/LCN abstraction) into Linux kernel context with different initialization disciplines. The driver is still finding its equilibrium in mainline. Treat new filesystem drivers with elevated scrutiny for initialization guarantees, not because they're poorly written, but because the on-disk semantic complexity creates traps that static analysis alone doesn't yet model consistently.

Reviewed through automated stages and approved by a human before publication.