A bug in the Linux kernel's NTFS3 file system driver causes an underflow when calculating the resident attribute data size during a UpdateResidentValue operation. The calculation incorrectly allows the size value to wrap around to approximately 4 GiB, which means that subsequent code can read up to 4 GiB beyond the 1 KiB MFT record allocation boundary. This out‑of‑bounds read could expose arbitrary kernel memory contents or corrupt data if the attacker can control the attribute values. Mounting an NTFS volume that contains such corrupted attributes will fail because a defensive check in mi_enum_attr rejects the invalid size, but a read path that selects an attribute by name and trusts the size value is not protected. Based on the description, the likely attack vector is local access to a Linux system with a mounted NTFS volume containing the malicious attributes; this is inferred from the requirement to manipulate lrh->attr_off etc.

all Linux kernel releases that include the ntfs3 driver are vulnerable until the patch that introduces explicit validation of the attribute offset and data size is deployed.

The CVSS score is 7.8, and the EPSS score is < 1%, so a precise likelihood estimate cannot be given. The vulnerability is classified as a serious potential for information disclosure or memory corruption. Attackers would need local access to a system with a Linux kernel that has not been updated, and they would need to supply a crafted NTFS file system image or mount a malicious NTFS volume. No exploit has been reported in the CISA KEV catalog, and the flaw is caught by a defensive path that aborts the mount for most scenarios, which reduces the practical risk for simple mounts. However, custom applications that bypass the defense or read specific attributes by name could still exploit the out‑of‑bounds read. Based on the description, it is inferred that the attacker must be able to supply or control the contents of an NTFS volume, implying local access. The likely attack vector is to mount a malicious NTFS volume or use a custom application that reads specific attributes by name.