During NTFS restart-table replay the kernel copies directory entries by using a length derived from the on-disk lcns_follow field. The field is not checked against the size of the entry, so a malformed NTFS image can supply an oversized value, causing the memmove to read or write beyond the allocated restart‑table buffer. This out‑of‑bounds memory corruption can crash the kernel or, if attacker-supplied data overwrites privileged control structures, provide a path to privilege escalation.

The flaw exists in the Linux kernel's ntfs3 filesystem driver. All Linux distributions ship the stock kernel with this driver, so any system running a kernel before the commit that introduced the new lcns_follow bounds check is potentially vulnerable. No specific version range is given, but all kernels dated before the patch are at risk.

The CVSS score of 7.8 indicates high severity, while the EPSS < 1% suggests the likelihood of exploitation is low but not zero. The CVE is not listed in CISA KEV. Based on the description, the likely attack vector involves an attacker creating a malicious NTFS image, mounting it, and triggering the log_replay routine. Successful exploitation could trigger a kernel crash or enable code execution in privileged context.