The vulnerability exists in the Linux kernel’s NTFS driver where resident $INDEX_ROOT values are not fully validated during lookup. In particular, invariant checks such as entries_offset alignment, index_length, and allocated_size consistency are missing or insufficient. This flaw allows an attacker to supply a crafted NTFS image that can cause the kernel to read or write memory outside the intended bounds, potentially leading to memory corruption or a kernel panic. The impact is a breach of kernel integrity and could provide a foothold for privilege escalation if the attacker controls the filesystem.

All Linux kernel instances running with the NTFS driver are affected. The exact kernel versions are not enumerated in the available data, so any kernel that has not incorporated the described fix is considered vulnerable.

The CVSS score is not provided and the EPSS score is not available, indicating that the likelihood of observed exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to provide a malicious NTFS filesystem or image to trigger the flaw, which could be delivered locally or over a network file share that mounts NTFS. Exploitation would require successful execution of the kernel with the vulnerability, so the risk remains undetermined but could be high if the attacker gains the ability to influence the filesystem. The lack of an EPSS score means there is no evidence of recent exploitation, but the absence of a KEV listing does not guarantee safety; the flaw still permits potential kernel memory corruption.