The vulnerability arises from a silent memory leak in the Linux kernel’s NTFS driver. When ntfs_fill_super encounters a failure path, it frees only the main volume structure while leaving several vol‐owned allocations—such as the NLS map, volume label, and page bits—intact. Over repeated mount failures these orphaned resources accumulate, potentially exhausting system memory and causing a denial of service. The leak is silent; no error is reported and inodes loaded before failure remain hashed, so the issue is not immediately visible to users.

The flaw exists in all Linux kernel releases that employ the legacy NTFS implementation before the patch commits identified in the kernel git tree. The fix restores proper cleanup on every error path and is incorporated into subsequent stable kernel releases. Systems running unsupported or older kernels without this patch are susceptible.

The CVSS score is 5.5 and the EPSS score is <1%, making a quantitative risk assessment possible; however, the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. It is inferred that an attacker who can trigger repeated NTFS mount failures—such as a user capable of mounting malicious or malformed NTFS volumes—could cause the memory leak to grow until system resources are exhausted, potentially leading to a denial of service. The attack surface requires the ability to mount NTFS filesystems, which is typically limited to users with appropriate privileges or the root user.