A flaw in the Linux kernel’s NTFS3 file system code permits the use of memory that has not been fully initialized when new folios are allocated and handled by ntfs_compress_write. This can cause kernel data structures to contain uninitialized values, which may expose sensitive information or lead to kernel crashes, thereby compromising system integrity and availability.

The vulnerability affects all Linux kernel implementations that include the NTFS3 file system module. The CI identifies the general product family, but no specific kernel version range is listed in the CNA data, so any distribution kernel that has yet to receive the fix is potentially impacted.

The CVSS score is not provided, and EPSS is unavailable, so the overall exploitation probability cannot be quantified from the available metrics. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered during a local file write operation that expects compression, a local privileged attacker could potentially leverage the kernel crash or memory disclosure by generating or manipulating NTFS3 file system data. The lack of a known remote attack vector suggests a local‑privilege level attack vector, but precise exploitation conditions remain unspecified by the vendor. The risk to confidential data and system stability exists until a kernel patch is applied.