An improper validation of resident NTFS attribute lengths in the Linux kernel’s ntfs module lets a crafted file system image set a small actual value length but a larger reported length, causing kernel code to read past the allocated buffer during a lookup. The bug was demonstrated as a slab out‑of‑bounds read, which can expose parts of kernel memory to an attacker. This vulnerability does not provide direct code execution but can lead to information disclosure or be leveraged as a foothold in further attacks.

Any Linux kernel build prior to the official patch that introduced a shared attribute value validator in the ntfs module is affected. The flaw resides in the core ntfs file system support, which is present in all mainstream distributions. The exact kernel versions lacking the fix are not specified, so any kernel not yet updated to the patched state is potentially vulnerable.

The CVSS score is 9.8, indicating critical severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog and no public exploits have been reported. However, the bug allows a local user (or possibly a remote user who can supply a malicious NTFS image) to read beyond the bounds of an NTFS attribute, potentially leaking kernel data. Due to the kernel‑space nature of the bug, exploitation requires the ability to mount or interact with a crafted NTFS image, making the attack vector less trivial but still relevant for systems that accept such images from untrusted sources.