A bug in the Linux kernel's NTFS3 implementation allows an unprivileged user to cause a bounded adjacent‑heap corruption by creating a file on a specially crafted NTFS image. The flaw occurs when the index root contains resident entries whose combined size exceeds the size of the buffer allocated for the promoted $INDEX_ROOT. During the promotion, the kernel copies attacker‑controlled data past the end of the allocated buffer, resulting in a controlled write of 120–136 bytes beyond the allocation. This write does not provide arbitrary address control but can corrupt neighboring kernel heap objects, which can lead to privilege escalation or denial of service if the corruption affects critical data structures. The vulnerability is a classic heap‑based buffer overflow (CWE-120), and the controlled write constitutes a bounded adjacent‑heap corruption primitive.

Linux kernel implementations that expose the NTFS3 filesystem module are affected. No specific kernel version range is listed in the available data, and vendor or product names are not detailed beyond the general Linux kernel. Administrators should review kernel release notes for the presence of the relevant patch commit.

The CVSS score of 9.8 reflects the potential for significant impact due to the ability to corrupt kernel heap objects. The vulnerability is exploitable by any local user who can create a file on a mounted NTFS volume; therefore, the attack vector is local and does not require elevated rights. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. While the flaw gives a bounded heap write rather than arbitrary memory control, it can corrupt adjacent objects and may lead to privilege escalation or a crash, depending on the surrounding slab layout. Because the conditions for successful exploitation—a specific layout of heap objects and the presence of a vulnerable NTFS image—are not guaranteed, the overall exploitability is moderate to high for environments that mount untrusted NTFS media.