This vulnerability is an infinite loop in the Linux kernel’s ntfs3 file‑system driver. A malformed directory entry can set a flag and change a pointer so that the lookup routine repeatedly reads the same block, allocating an additional 4 KB of memory on each iteration. Because the kernel lacks loop detection, the allocation continues until the system runs out of memory, triggering an out‑of‑memory kill and a kernel crash. The patch corrects this by checking the return code from a helper function, breaking the loop when an array is full, and preventing the memory exhaustion. The flaw is identified as a classic infinite‑loop problem (CWE‑835). An attacker who can supply a crafted NTFS volume that is mounted by the kernel can exploit the flaw; the kernel will hang during lookup operations and the entire system can become unresponsive. Because the exploit requires a malicious file system that the kernel mounts, the attack is local; network or remote interfaces are not involved. The result is a denial‑of‑service condition that affects the host where the volume is mounted.

All Linux systems that run a kernel containing the unpatched ntfs3 driver and are capable of mounting NTFS volumes are vulnerable. No specific kernel release was listed in the CNA data, so any kernel that has not yet incorporated the described patch is potentially affected. Users should verify whether their installed kernel version contains the commit that adds the return‑value check.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests the exploitation probability is low, and the flaw is not in the CISA KEV catalog. The attack vector is local, inferred from the need to mount a malicious NTFS volume. The exploit requires only that the target system access the vulnerable file system; no network privileges or credentials are needed. Consequently, this DoS risk is primarily relevant to systems that mount or expose NTFS partitions from untrusted sources.