In the Linux kernel, the ntfs3 driver converts the on‑disk NTFS volume label from UTF‑16 to UTF‑8, storing it in sbi->volume.label. The conversion routine does not append a terminating NUL, so when a label is exactly the size of the buffer, the display function ntfs3_label_show() can read past the end of the buffer while searching for a terminator. This out‑of‑bounds read can expose arbitrary kernel memory to the caller, potentially leaking sensitive data.

All Linux kernel implementations containing the ntfs3 filesystem driver before the patch. Specific affected versions are not listed, so any kernel that has not yet incorporated the fix should be considered vulnerable.

The vulnerability does not allow code execution; it permits a local or privileged attacker to read beyond the boundary of the volume label buffer. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is unlikely at present. Nevertheless, the ability to read kernel memory can aid in further privilege escalation or information gathering, making the risk significant for systems that mount NTFS partitions on untrusted media.