The Linux kernel's NTFS driver returns MFT references read from disk without validating the error‑mark bit. A malicious NTFS image can set the MREF error bit and leave the low bits arbitrary, causing callers to treat the value as a bogus pseudo‑errno instead of recognizing corrupted metadata. This flaw may lead to erroneous kernel behavior or denial of service because operations on corrupted file system objects are not properly prohibited.

All Linux distributions that ship the current kernel without the recent ntfs lookup sanitization patch are affected. The vulnerability resides in the core kernel NTFS module; no specific version numbers are listed in the CNA data, but any kernel lacking this fix is considered vulnerable.

The exploit requires the ability to present a crafted NTFS image to the kernel, which is typically possible by mounting a malicious file system. The vulnerability does not have an assigned EPSS or CVSS score in the data, and it is not listed in the CISA KEV catalog. However, because the flaw can trigger kernel misbehavior during file system operations, the potential impact could be high. An attacker with access to mount privileges or who can supply a custom NTFS image could exploit this to cause a denial‑of‑service condition.