The bug resides in the NTFS3 driver of the Linux kernel; the function that checks file record headers validates only the total size of a record, not the used field. When the used value is extracted from disk and used to compute the length of a memmove, a subtraction can underflow. This causes the kernel to copy data into a fixed 4 KB buffer that may then contain data far beyond the intended size, potentially corrupting nearby kernel memory. The vulnerability is an example of an out‑of‑bounds write that can lead to memory overwrite in kernel space.

All Linux systems that load the NTFS3 driver are affected. The vulnerability is present in the generic Linux kernel tree, so any distribution that includes the ntfs3 module before the patch is susceptible. No specific kernel version information is given, so the issue applies to any kernel build that has not yet incorporated the bounds check.

The flaw requires a corrupted NTFS filesystem; no remote attacker interfaces are described. The likely attack vector is a local attacker who can create or manipulate NTFS data that triggers journal replay after the system reboots or during an ongoing session. EPSS data is currently unavailable, and the issue is not listed in the CISA KEV catalog. Thus, exploitation would depend on local or privileged access to a system with a damaged NTFS partition that undergoes journal replay, and the overall risk is moderate for such environments.