The Linux kernel’s NTFS driver returns MFT references read from disk without validating the error‑mark bit, which is an improper input validation flaw. A malicious NTFS image can set the MREF error bit while leaving the low bits arbitrary, so callers interpret the value as a bogus pseudo‑errno rather than recognizing corrupted metadata. This misinterpretation may result in erroneous kernel behavior, reflects improper error handling (CWE-252), and can lead to a denial‑of‑service condition.

All Linux distributions that ship a kernel version lacking the recent ntfs lookup sanitization patch are affected. The flaw exists in the core kernel NTFS module; any kernel lacking this fix is considered vulnerable, regardless of specific version numbers.

Based on the description, the likely attack vector is mounting a malicious NTFS filesystem to supply crafted metadata. The exploit requires the ability to present a crafted NTFS image to the kernel, normally possible by mounting such a filesystem. The vulnerability has a CVSS score of 9.1, an EPSS score of <1%, and is not listed in the CISA KEV catalog. Given its potential to trigger kernel misbehavior during filesystem operations, the impact could be high, and an attacker with mount privileges or who can supply a custom NTFS image could exploit this to cause a denial‑of‑service condition.