The Linux kernel’s NTFS driver previously performed insufficient validation of the INDEX_HEADER geometry in INDX blocks. This lack of checks could allow a malformed INDX block in an NTFS file system to be processed without proper validation, potentially leading to undefined kernel behavior when a lookup operation is performed. The fix introduces stricter header validation and ensures the lookup routine enforces these checks. The nature of the deficiency is a data integrity weakness, classified as CWE-1288.

All Linux kernel releases that include the legacy NTFS driver and have not yet incorporated the stricter header‑validation patch are affected. The exact version scope is not listed in the data, so any kernel containing the unpatched ntfs_index_block_inconsisent() routine may be vulnerable.

The CVSS base score of 9.8 emphasizes the severity of the issue, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require the kernel to mount a malicious NTFS volume with malformed INDX blocks, implying a likely local or possibly remote mounting vector. Results could include kernel instability or crash, but the exact impact is not explicitly defined in the description.