The flaw resides in the Linux kernel's ntfs3 filesystem driver, where a DeleteIndexEntryAllocation operation feeds an unvalidated on‑disk size value into a memmove call. If that size is excessively large and causes a signed integer underflow when computing the destination address, the resulting memmove length becomes a huge unsigned value. The kernel then writes past the end of the buffer, triggering an oops that can lead to a kernel panic. The crash occurs when the kernel processes a crafted NTFS image, but no user‑level code execution is indicated in the report.

Any Linux system that incorporates the mainline ntfs3 driver compiled into its kernel is vulnerable. This includes servers, desktop, and embedded devices running recent distributions such as Ubuntu, Debian, Fedora, RHEL/CentOS, openSUSE, and others that ship with the mainline kernel. No specific kernel version is listed, so versions built before the commit that introduced the fix are considered at risk.

Exploitation requires an attacker to supply a malicious NTFS image that the kernel mounts, which can be achieved by placing the image on a device the system accesses, or via remote file‑system sharing if the attacker controls the mount point. The attack is limited to users with permission to mount the filesystem. Once the malicious memmove overflow is triggered, the kernel will oops, resulting in a denial of service. The CVSS score of 8.4 indicates a high severity. The EPSS score is < 1%, indicating a very low probability of exploitation at this time, and the vulnerability is not listed in CISA KEV. The low EPSS score does not mitigate the fact that the flaw can crash any kernel instance that processes a crafted NTFS volume, so environments handling untrusted NTFS images remain at elevated risk.