The Linux kernel NTFS driver contains a flaw in which the function that rolls back a failed index‑block write, post_write_mst_fixup(), is invoked even when the preceding error stems from an invalid index block rather than an I/O failure. This unchecked call assumes the index block is valid and performs no boundary checks, resulting in out‑of‑bounds memory reads or writes. An attacker who supplies a crafted NTFS image that misrepresents the index block—using an excessively large offset, a zero count that triggers an integer underflow, or a count larger than the actual number of sectors—can force the kernel to access arbitrary memory, potentially corrupting kernel data structures and enabling privilege escalation or denial of service.

All Linux kernel installations that mount NTFS file systems without the patch that moves the post_write_mst_fixup() call into ntfs_ib_write() are vulnerable. Any kernel revision released before the advisory fixes is affected, regardless of the exact version number. The vulnerability is specific to the NTFS module and does not affect other file systems.

The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% suggests that exploitation is presently rare, and the vulnerability is not listed in the CISA KEV catalog. An attacker must supply a malicious NTFS volume and trigger a write operation that causes the kernel to synchronize an inode. The likely attack vector inferred from the description is local access—an attacker who can place a crafted NTFS image on a mounted volume (for example, from a USB drive) can induce the failure. Although exploitation statistics are low at present, the potential for arbitrary kernel memory corruption makes the threat significant.