The Linux kernel’s ntfs_fill_super() function fails to free the memory that stores NTFS mount options because it sets its pointer to NULL without deallocating the existing data. This oversight causes kmemleak to report an unreferenced object containing the leaked data. The defect does not introduce memory corruption or unauthorized access; it simply allows a memory leak to persist.

All Linux kernel builds that include the fs/ntfs3 subsystem and lack the commit referenced by the patch (dac871d833b09495198dcac81d2ebaa8db11acbc) are affected. The specific kernel versions susceptible to the leak cannot be enumerated from the available data, but any kernel without this patch exposes the issue.

The CVE is not listed in CISA’s KEV catalog, and no EPSS score is available. The likely attack vector involves a local privileged process that performs a mount operation on an NTFS image, as demonstrated by the reproduction steps provided. Because the vulnerability does not grant remote code execution or privilege escalation and only results in a memory leak detectable by kmemleak, the overall risk is considered low, contingent on update or mitigation measures.