The vulnerability arises in the NTFS run‑list parser of the Linux kernel. It accumulates relative logical cluster number deltas in a signed 64‑bit integer. A crafted runlist can drive this accumulator to its maximum value and then add another delta, causing a signed integer overflow. The overflow is undefined and can cause a corrupt NTFS volume to be treated as a different sequence of physical clusters, potentially resulting in read or write errors and data loss.

The flaw is present in the core Linux kernel. All Linux distributions that ship the vanilla kernel and have not applied the commit that fixes the overflow are vulnerable. No specific kernel release is mentioned, meaning every unpatched release is at risk until the patch is applied.

The likely attack vector is a malicious NTFS volume containing a corrupted runlist that the kernel mounts. The vulnerability is not listed in CISA's KEV catalog and its EPSS score is < 1%. Exploitation would therefore require the kernel to parse a manipulated NTFS attribute on a storage device accessible to the system, implying a local or physical‑access attack surface. While the impact is limited to data integrity and does not provide code execution, the undefined behavior and potential for widespread data corruption, combined with a CVSS score of 9.8, indicate a high‑severity flaw from a kernel reliability perspective.