The vulnerability is an infinite loop in the ntfs3 filesystem driver of the Linux kernel. A maliciously crafted dentry can set the HAS_SUB_NODE flag and manipulate the VCN pointer in an INDEX_ENTRY so that the indx_find() routine repeatedly reads the same block. Each iteration allocates an additional 4 KB of memory without any loop detection or depth limits, exhausting kernel memory and triggering an OOM kill. The problem is mitigated by checking the return value of fnd_push() so that when the index exceeds the fnd->nodes array, the function returns -EINVAL and the loop is terminated. This prevents the memory exhaustion and kernel crash that would otherwise result.

All Linux systems that use the Linux kernel and are capable of mounting NTFS3 file systems are affected. No specific kernel versions are listed in the CNA data, so any kernel that contains the unpatched ntfs3 driver is potentially vulnerable. Users should verify whether their kernel contains the patch by checking the commit referenced in the CVE description or the kernel release notes.

The CVSS score is not provided, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local: an attacker must be able to provide a malformed NTFS file system, either by creating a malicious volume or by compromising a system that mounts an untrusted volume. Once the malicious ATA volume is mounted, the kernel will hang during lookup operations, leading to a denial-of-service condition. The exploit requires file system manipulation and no network or web interface; therefore the risk is high for systems that mount untrusted NTFS volumes or run with insufficient isolation.