The Linux kernel NTFS3 driver contains a function, indx_find_buffer(), that recurses through a B+ tree index without imposing a depth limit. When an NTFS volume is engineered to include circular index node references, the recursion becomes infinite, eventually overflowing the kernel stack and causing the system to panic. The failure to limit recursion results in a local denial‑of‑service event manifested as a kernel crash, compromising system availability.

All Linux kernel builds that omit the depth‑limit patch to indx_find_buffer() are affected. This includes every distribution kernel prior to the inclusion of commit 1ebd684b8f627f75bc3e03f8b2ad8400fd1f02cd, which added a parameter to abort the search when the node array bound is reached. Any system running such a kernel, regardless of architecture, is susceptible if it mounts a malicious NTFS filesystem.

The vulnerability is exploitable by mounting a crafted NTFS filesystem—an operation that is typically performed automatically when a USB drive is inserted or can be triggered manually by a local user. The attack requires only the ability to mount the volume, which is generally available to ordinary users on desktop systems; no elevated privileges are needed. The EPSS score is listed as less than 1%, indicating that known exploitation attempts are rare, yet the low exploitation probability does not diminish the severe impact once the conditions are met. The risk is therefore moderate to high for systems that accept untrusted NTFS media or where automatic mounting is enabled.