This vulnerability exists in the Linux kernel’s NTFS driver, where resident $INDEX_ROOT values are not fully validated during lookup. The missing checks include entries_offset alignment, index_length bounds, and allocated_size consistency. Without these validations, the driver can read memory outside the intended region, potentially leading to memory corruption or a kernel crash. This weakness corresponds to CWE-1288.

All Linux kernel instances that use the NTFS driver and have not applied the fix referenced in the provided commit links—any kernel before the patch that addressed missing root header validation is vulnerable.

The CVSS score is 9.8, indicating critical severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply a malicious NTFS filesystem or image to trigger the flaw, which could be delivered through local access or a network mounted share. The vulnerability allows memory corruption in the kernel, but no specific evidence of widespread exploitation exists.