A malformed NTFS filesystem entry can cause the ntfs3 driver to read an excessively large entry size in the DeleteIndexEntryRoot routine. The missing bounds check allows the code to compute a pointer beyond the buffer and later use it as the size in a memmove, which interprets the negative offset as a huge unsigned value and writes past the allocated heap area. This kernel‑heap buffer overflow can corrupt kernel memory and is a known way to gain high‑privilege code execution on the host.

All Linux kernel releases that contain the ntfs3 driver before the patch are affected. The vulnerability exists in the core NTFS filesystem driver shipped with the Linux kernel. No specific version numbers are listed, so any unpatched kernel that still uses the vulnerable code path (including mainstream distributions’ default kernels) should be considered at risk until a fix is applied.

The CVSS score is not provided and EPSS is not available, but the presence of a kernel‑level heap overflow implies a high impact if exploited. The vulnerability is listed as not included in CISA’s KEV catalog. Exploitation would require the attacker to present a crafted NTFS volume containing a malicious index entry; a local attacker with access to the USB or disk device could supply it. In environments where the system mounts such a volume over a network share or accepts external devices, remote exploitation may be possible. An unpatched kernel is therefore at significant risk of privilege escalation or arbitrary code execution.