The vulnerability stems from inadequate validation of the $INDEX_ROOT section within the NTFS filesystem driver in the Linux kernel. Malformed or inconsistent header data could be accepted when reading directory and named‑index inodes, potentially leading to incorrect processing or a kernel error. The patch introduces a helper that enforces stricter checks on the root size and header geometry, ensuring only well‑formed NTFS structures are processed.

All Linux kernel versions that include NTFS support and have not yet incorporated the fix from the referenced upstream commits are affected. Because the weakness resides in the generic kernel source, it applies to every distribution shipping a kernel with built‑in or module‑based NTFS support.

Based on the description, it is inferred that the likely attack vector is presenting malicious NTFS data—such as via removable media or a crafted file system image—to the kernel. The CVSS score of 8.4 indicates a high severity vulnerability, while the EPSS score of <1% denotes a low likelihood of exploitation. The issue remains unlisted in the CISA KEV catalog. The flaw could be triggered by presenting malicious NTFS data—such as via a removable media device or crafted filesystem image—potentially leading to a kernel error or crash. While no publicly documented exploits exist, the potential impact makes the vulnerability of concern for systems that expose the kernel to untrusted NTFS data.