In Linux kernels, the NTFS3 driver contains an unchecked memmove operation in UpdateRecordDataRoot and UpdateRecordDataAllocation where the destination is calculated from e->view.data_off without verifying that the offset plus length stays within the NTFS_DE structure. This out‑of‑bounds write of up to 32 bytes can corrupt kernel memory when an attacker supplies a malicious NTFS volume. The resulting memory corruption can enable arbitrary code execution or force a system crash because the affected code runs with kernel privileges.

The vulnerability exists in any Linux kernel lacking the commit 8d90b09e6741 that adds the missing bounds checks. This includes all mainline kernels older than that commit, spanning multiple mainstream releases. Kernels that have been updated to contain the patch are not affected.

The CVSS base score of 7.8 indicates high severity, while the EPSS score of <1% suggests a very low likelihood of current exploitation. The flaw is not listed in CISA’s KEV catalog. An attacker would need to mount or otherwise introduce a corrupted NTFS file system to trigger the out‑of‑bounds write, which is a local attack vector. Once triggered, the kernel memory corruption can lead to local privilege escalation or denial of service. This weakness is classified as CWE-120.