The NTFS driver for Linux erroneously exposes critical metadata files (such as $Bitmap) through the show_sys_files interface and allows them to be written from user space. Because these files are internal to the filesystem and should never be modified, such writes corrupt the volume. The corruption can also trigger a deadlock in the cluster allocator when it attempts to reconcile the bitmap with its own cached pages, potentially causing a kernel hang. The flaw effectively permits users to overwrite protected filesystem structures, leading to data loss, filesystem instability, and potential denial of service.

Affected systems are Linux distributions that ship the default kernel with the NTFS driver containing this bug. The advisory does not specify a particular version, meaning any kernel build that has not applied the commit referenced in the advisory is vulnerable. The bug is not limited to specific hardware or kernel configurations, but is contingent on the presence of an NTFS volume and the ability to write to it from userspace.

The CVSS score is not disclosed and EPSS is unavailable, so the quantified risk remains indeterminate. The vulnerability is not listed in the CISA KEV catalogue, indicating no known public exploits. Nonetheless, exploitation requires local access to an NTFS volume that is writable, making it a local privilege exploitation vector. Successful exploitation results in critical filesystem corruption and system instability, so the risk to affected systems is high if the issue is present.