The vulnerability arises because the shared lookup‑time attribute validator in the Linux kernel does not reject non‑resident NTFS attribute records for attributes that must be resident. Callers that expect resident attributes use the data.resident.value_offset field directly without first checking whether the record is truly resident. This mismatch can cause the kernel to read an unexpected offset, potentially leading to incorrect attribute handling or kernel instability. The CVE description does not specify a concrete exploit outcome beyond this incorrect processing.

Linux kernels that load the ntfs kernel module and mount NTFS file systems. All kernel releases that use the legacy resident/non‑resident attribute handling are affected; no specific version restrictions are documented.

The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability has not been listed in CISA’s KEV catalog. Because the flaw involves kernel handling of NTFS volumes, an attacker would need local access to an NTFS filesystem and the ability to supply or modify attribute data. The potential impact is limited to incorrect kernel behavior; no specific privilege escalation or crash has been documented in the CVE.