The vulnerability resides in the Linux kernel NTFS module’s attribute insertion routine. When ntfs_non_resident_attr_insert_range allocates a temporary runlist structure and ntfs_attr_map_whole_runlist fails, the error path releases the runlist lock but fails to free the allocated hole_rl, leaking a small memory block (size: sizeof(*hole_rl) * 2 bytes). Because the leaked memory is not reclaimed, repeated failures could accumulate and exhaust system memory, degrading availability. The weakness is a classic memory‑leak flaw (CWE-401) and an unreleased resource issue (CWE-772).

The flaw is present in the NTFS driver that ships with most kernel releases. Any machine running a kernel containing this legacy NTFS driver without the patch is affected. The vulnerability applies broadly to all current kernels until the patch is integrated, regardless of distribution or hardware platform.

The CVSS score of 5.5, the EPSS score is < 1%, and the flaw is not listed in CISA KEV, indicating that publicly documented exploits are absent. Based on the description, it is inferred that an attacker would need to induce the specific mapping failure in the NTFS attribute insertion routine—most likely by supplying a failing or malformed attribute structure—to trigger the memory leak. The overall risk is therefore moderate to low, with the primary threat being a potential denial‑of‑service condition if failures recur frequently. The attack vector is local or application‑level, requiring interaction with the NTFS subsystem.