An infinite loop bug exists in the Linux kernel’s ntfs3 filesystem driver. When a malformed NTFS image contains an ATTR_LIST attribute with zero data size, the driver attempts to allocate memory for it, discovers an inconsistent state, and repeatedly reloads and re‑enumerates the attribute list. This causes the mount operation to hang indefinitely, effectively denying service to the affected volume.

Any system running a Linux kernel that includes the ntfs3 driver and mounts NTFS volumes is vulnerable. Because the advisory does not list specific kernel versions, all releases before the patch that contain the unmodified ntfs3 code are considered affected. This includes desktop, server, and embedded Linux environments that might automatically mount removable storage devices.

The exploit probability (EPSS) is below 1% and the vulnerability is not present in CISA’s KEV catalog, indicating a low likelihood of exploitation. The attack vector is inferred to involve an attacker presenting a crafted NTFS image to a system that mounts it, which then triggers the infinite loop and hangs the kernel thread. The impact is limited to denial of service; there is no evidence of privilege escalation or data compromise.