During mounting of an NTFS filesystem, a crafted filesystem image can trigger an out‑of‑bounds write during the log replay routine. The routine copies logical cluster numbers into an existing dirty page table entry without bounding the destination index, leading to a heap buffer overflow and an out‑of‑bounds write (CWE‑787). This kernel memory corruption can result in kernel memory damage and potentially arbitrary code execution as the victim kernel processes the malicious image.

All Linux systems that use the kernel’s native ntfs3 filesystem driver are susceptible. The advisory does not specify a version range, so any kernel build that has not incorporated the patch that added the bounds check remains vulnerable. Kernel developers refer to the git commit that introduced the validation logic for a precise version reference, and Linux vendors should verify that their current kernel includes this change.

The CVSS score of 7.8 indicates high severity, while the EPSS of < 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the defect allows a kernel out-of-bounds write during mount, local privilege escalation or denial of service are plausible if an attacker can supply a malicious NTFS image, typically requiring elevated rights to mount the filesystem.