The fix for this CVE addresses an oversight in the NTFS attribute validation routine. Resident-only attributes such as $FILE_NAME and $VOLUME_NAME are required to be resident, but the code incorrectly allowed non-resident records for some resident-only types. This omission permits certain file system entries that are marked non-resident to be read as resident, leading the kernel to interpret the wrong memory region. The resulting out‑of‑bounds read can expose kernel memory to untrusted users and provides a pathway for local privilege escalation or denial of service.

Any Linux kernel that loads the ntfs module and handles NTFS file system metadata. The vulnerability applies broadly across all kernel versions that employ the standard resident/non‑resident attribute handling described, with no specific version restriction noted in the advisories or CPE listing.

While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, its severity is high because it involves a kernel memory read that can elevate local user privileges. The likely attack vector is a local user with the ability to manipulate an NTFS volume: by crafting attributes that violate the resident‑only contract, the attacker can trigger the kernel to read arbitrary kernel memory. Consequently, organizations should treat the issue as a critical exposure and pursue remediation promptly.