In the Linux kernel NTFS driver, an attribute‑list update performed during cluster allocation can drop the last reference to a temporary attribute inode. When that inode is evicted, it releases its reference to the base inode, which can trigger ntfs_drop_big_inode() from within the base inode's own writeback path. If the base inode has been unlinked, ntfs_drop_big_inode() calls truncate_setsize() while the inode’s folio writeback is still in progress. Because the same writeback worker is responsible for completing that writeback, it ends up waiting for itself indefinitely, which results in a kernel hang. The failure manifests as a denial of service that stops the kernel or blocks NTFS file operations.

All Linux kernel builds that include the NTFS filesystem driver before the hotfix is applied are potentially vulnerable. The advisory does not specify exact kernel releases, so any version of the kernel compiled with NTFS support that predates the patch cannot be excluded.

The EPSS score is reported as < 1%, indicating a very low probability of exploitation in the wild. The CVSS score of 5.5 denotes moderate severity and suggests that the vulnerability can cause denial of service. No public exploits or listings in CISA KEV are known. The fault is triggered by operations that manipulate NTFS attributes, including creating, modifying, or unlinking files, which can be performed by any user who has write access to an NTFS volume.