The vulnerability resides in the Linux kernel's NTFS3 file system subsystem. A missing run load for the first VCN in the attr_data_get_block_locked() function allows the run lookup for the base block to fail, producing a WARN_ON(1) that can lead to an Oops and kernel panic. The lack of proper run initialization can therefore induce a denial‑of‑service condition on affected systems.

All Linux kernels that include the ntfs3 module before the patch commit are affected. The fix was applied in commit 2b4ae1c and d7ea8495, so any distribution shipping a kernel prior to those commits contends with this defect. The issue is limited to systems that mount or otherwise access NTFS volumes using the kernel NTFS3 driver.

The CVSS score is not publicly listed, and the EPSS value is unknown at this time, indicating no reported exploitation activity. The kernel warning can be triggered by a file system operation that accesses a compressed or sparse attribute whose first cluster does not align with the frame start. An attacker with local privileges or an adversary who can force the kernel to read a crafted NTFS volume could exploit the bug, though no remote code execution is evident. The lack of KEV listing suggests low to moderate priority for threat actors; nevertheless, the potential for a system crash warrants prompt attention.