The vulnerability resides in the Linux kernel’s NTFS3 file system subsystem. A missing run load for the first VCN in the attr_data_get_block_locked() function allows the run lookup for the base block to fail, producing a WARN_ON(1) that can lead to an Oops and kernel panic. The lack of proper run initialization can therefore induce a denial‑of‑service condition on affected systems.

All Linux kernels that include the ntfs3 module before the patch commit are affected. The fix was applied in commit 2b4ae1c and d7ea8495, so any distribution shipping a kernel prior to those commits contends with this defect. The issue is limited to systems that mount or otherwise access NTFS volumes using the kernel NTFS3 driver.

The CVSS score is 5.5, which indicates a medium severity vulnerability. Though the EPSS score is still <1%, implying a low likelihood of exploitation, the kernel warning can be triggered by accessing a compressed or sparse attribute whose first cluster does not align with the frame start. An attacker with local privileges or an adversary who can force the kernel to read a crafted NTFS volume could exploit the bug, although no remote code execution is evident. The absence of this vulnerability from the CISA KEV catalog suggests a lower priority for threat actors, but the potential for a system crash still warrants prompt attention.