The Linux kernel’s NTFS3 driver contained logic that allowed a local variable, the logical cluster number (lcn), to be used before it was initialized. The bug caused the filesystem mapping routine to jump to success paths with an uninitialized value, potentially corrupting kernel memory or causing an Oops. This flaw is a classic use‑of‑uninitialized‑variable error that could lead to a kernel crash or unpredictable behaviour, resulting in a denial of service on the affected system.

The vulnerability is present in the generic Linux kernel implementation wherever the NTFS3 filesystem code is compiled. No specific version range was supplied in the CVE entry, so any kernel build that includes the unpatched ntfs_iomap_begin routine is potentially affected.

Because the flaw requires the kernel to process NTFS filesystem requests, it is typically limited to environments where an NTFS volume is mounted or accessed locally. The entry does not provide a CVSS score or EPSS value, and it is not listed in the CISA KEV catalog, suggesting the exploitation likelihood is relatively low but not zero. An attacker with the ability to influence filesystem activity or to trigger the uninitialized variable can force a kernel crash, giving them a downgrade of system availability. No known public exploit exists at the time of this analysis.