The vulnerability resides in the Linux kernel's NTFS3 driver. A circular lock dependency exists between the MFT zone read lock and the file run lock. If a user triggers file extensions while the NTFS driver is refreshing zones, the driver may acquire these locks in opposite order, leading to an AB‑BA deadlock. The result is a kernel stall or system hang, effectively denying service for the affected system. The weakness is a classic lock‑deadlock scenario.

The issue is present in generic Linux kernel versions that contain the NTFS3 code paths described above, before the patch that replaces the blocking lock acquisition with a try‑lock. No specific distribution or kernel release is listed, so any Linux distribution using an older kernel that does not include the latest NTFS3 changes is potentially affected.

The attack vector is local; any user capable of performing NTFS operations on the system can trigger the deadlock by extending the MFT. While there is no documented remote exploitation path, a local attacker who can generate heavy NTFS traffic could bring the system to a halt. The EPSS value is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting limited public exploitation. However, the severity can be high (functionally equivalent to a denial of service). The main risk is that a prolonged deadlock can lock out users and services until a reboot or kernel recovery is performed.