The NTFS driver contains a flaw in the function that maps runlists when the driver expects a non‑resident attribute but receives a resident one. The code incorrectly accesses the non_resident union member of a resident attribute, corrupting the VCN range check. In the legacy implementation this mistake caused only a WARN_ON() to be triggered, which did not halt execution. The recent patch replaces the warning with a proper -EIO error return, causing a crafted NTFS image to be rejected during mounting rather than silently producing a warning.

Linux systems running a kernel that implements the legacy NTFS module before the commit that introduces the missing guard (commits b397b1238a217264bb02f963a1a1eadf71906375 and b8d6c528e9d57d263fee1a648409f84a68b2561d). All distributions that ship the stock Linux kernel at that point or earlier are potentially affected until the kernel is updated or the NTFS module is disabled.

The CVSS score of 9.8 marks the vulnerability as critical. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. An attacker would need to craft a malicious NTFS volume and trigger a mount operation; no additional local privilege escalation is required. On affected kernels the malformed image will result in an -EIO error and the volume will fail to mount, denying the attacker access to the filesystem.