A flaw in the Linux kernel’s NTFS3 file system code allows new folios to be allocated without proper up-to-date marking. During compress write operations, the function ntfs_compress_write calls longest_match_std while ni_read_frame is omitted, causing parts of the reserved memory to remain uninitialized. This leads the kernel to read or expose data that has never been set, which can leak information or produce undefined behavior, potentially destabilising the kernel or corrupting data.

The vulnerability affects any Linux kernel that includes NTFS3 support. No specific kernel version is listed in the CNA data, so all distributions running a kernel with NTFS3 that has not yet received the fix are potentially impacted.

The EPSS score is below 1% and the bug is not listed in the CISA KEV catalog, indicating a very low probability of exploitation. The flaw is triggered by a local NTFS3 write operation, so a local user with sufficient privileges to create or modify files could provoke the uninitialized memory condition. Though no remote or privilege‑escalation path is confirmed, the presence of uninitialized kernel data can compromise system integrity or availability if exercised.