The Linux kernel’s NTFS subsystem contains a logic flaw in the function that manages resident attribute resizing. When an attempt to enlarge a resident $DATA attribute fails, the kernel may convert zero‑length resident attributes to non‑resident to free space in the MFT record. Because fsck interprets zero‑byte non‑resident $DATA attributes as corrupt, this flaw can lead to diagnostics of corruption or, if acting upon such diagnostics, inadvertent data loss. The vulnerability does not provide remote execution capabilities, but it can be abused in scenarios that require local manipulation of NTFS files on a system running the affected kernel.

All Linux kernel releases that contain the legacy ntfs_resident_attr_resize path are affected, as the data does not list any version constraints. Users running any kernel with the default NTFS support should verify that the patch originated by the commits linked in the references has been applied. No vendor‑specific product version details are available.

The CVSS score is 9.8, and the EPSS score indicates a very low exploitation probability of less than 1%. Based on the description, the attack vector is inferred to be local only, requiring the attacker to manipulate NTFS attributes directly on the system. Because the flaw affects only local file‑system operations and requires the attacker to influence NTFS file attributes, the likelihood of widespread exploitation is low. The vulnerability is not listed in the CISA KEV catalog, and no public exploit evidence has been reported. Nevertheless, an attacker with local access capable of creating or modifying NTFS metadata could trigger filesystem inconsistencies and potential data loss.