This vulnerability occurs in the Linux kernel's NTFS3 filesystem driver. When processing a range of valid offsets during a write operation, the code fails to detect when the computed "valid" value remains unchanged. As a consequence, the loop can iterate endlessly, potentially hanging the kernel. The defect corresponds to a resource exhaustion weakness (CWE-770). The result is a denial of service, where an attacker who can supply a maliciously crafted NTFS volume can render the system unresponsive.

The flaw affects all Linux kernel releases that include the ntfs3 driver prior to the applied patch. No specific kernel versions are listed in the CNA data; any kernel running ntfs3 without the fix may be vulnerable.

The CVSS score is not provided, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires local access to mount or write to an NTFS3 filesystem, as the flaw is triggered during write operations. An attacker can craft an NTFS volume that causes the driver to loop indefinitely, provoking a kernel hang. The patch prevents the loop by terminating with -EINVAL when the computed "valid" value repeats.