The ntfs3 module performs an index insertion that uses a split‑point offset derived from the filesystem image without ensuring the offset plus its declared size stays within the header’s used area. This can cause an unsigned subtraction underflow, leading to a memmove with a count near 4 GiB and an out‑of‑bounds write that corrupts adjacent kernel memory. A kernel panic results; the description does not indicate privilege escalation or arbitrary code execution.

The vulnerability affects Linux kernels that include the ntfs3 module before the commit 1758a564b6ebe7f4a82f23c9851d1cae15549457. The CVE data does not list exact version ranges, so the precise scope is inferred: all 6.x kernels and 7.x kernels prior to the inclusion of this patch are likely vulnerable. The flaw is triggered by mounting an attacker‑supplied NTFS image from removable media, loopback devices, or auto‑mounts, and requires local access to mount the filesystem.

The EPSS score is reported as < 1 %, indicating a very low exploitation probability at the time of analysis. The CVSS score of 9.8 indicates a critical severity level. The vulnerability is not listed in the CISA KEV catalog and no public exploit has been reported. The attack requires local privilege to mount a malicious NTFS image, so environments with restricted media mounting or the capability to mount arbitrary filesystems mitigate the risk. Despite the low probability, the impact of a kernel crash is high because it can interrupt services or reboot the system.