The ntfs3 driver’s DeleteIndexEntryRoot routine incorrectly trusts the entry size extracted from a log record. The code calculates a pointer beyond the end of the buffer and then uses it as the size argument to memmove. When the entry size is unreasonably large, the subtraction yields a negative offset that, when cast to an unsigned size_t, becomes a large positive value, causing a heap buffer overflow. This overflow can corrupt kernel memory, making it a CWE‑805 vulnerability that can lead to privilege escalation.

All Linux kernels that include the unpatched ntfs3 driver are affected. This includes the default kernel packages shipped by Linux distributions that have not yet applied the commit that adds the bounds check. No specific version numbers are listed, so any kernel running the vulnerable code is considered at risk until a patched version is installed.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker would need to supply a crafted NTFS volume containing a malicious index entry to the kernel, typically by mounting a USB or block device that contains the malicious data. If the system accepts external storage or mounts untrusted media, the attack could potentially be remote. Exploitation could allow an attacker to corrupt kernel memory and gain elevated privileges.