The ntfs3 module’s log_replay routine copies LCN entries without ensuring that the destination index stays within the allocated buffer. When a malformed log record header is processed, the copy can write past the end of the page_lcns array on the kernel heap. This out‑of‑bounds write can corrupt arbitrary kernel memory, potentially allowing an attacker to crash the system or overwrite critical data structures to gain elevated privileges.

All Linux distributions that contain a vulnerable version of the ntfs3 file system module are affected. The missing bounds check exists in the mainline kernel source and would be present in any kernel shipped prior to the patch, regardless of distribution. Without an explicit version list, all current releases containing the default ntfs3 driver should be considered vulnerable until the fix is incorporated.

The advisory lists a CVSS score of 8.4, indicating high severity, while the EPSS score is below 1 % and the vulnerability is not present in CISA’s KEV catalogue. The flaw requires a locally available, specially crafted NTFS volume or log replay operation to trigger the out‑of‑bounds write. Because the write occurs in the kernel, an attacker who can induce the failure can crash the system or, on a successful exploitation path, achieve privilege escalation to root.