The Linux kernel’s NTFS module contains an off‑by‑one error in the ntfs_mapping_pairs_decompress function. The bounds checks use a strict greater‑than comparison, allowing a one‑byte out‑of‑bounds read when the mapping pair data extends exactly to the attribute end. This read can expose kernel memory that is not part of the NTFS structure. Based on the description, it is inferred that an attacker could read arbitrary data from kernel space if they supply a crafted NTFS file, leading to potential information disclosure.

All Linux kernel releases that include the unpatched ntfs_mapping_pairs_decompress function are affected. This includes every distribution shipping a stock kernel with NTFS support prior to the commit that introduced the fix. The exact kernel version range is not listed in the CNA data, so any system running a kernel older than the fix commit remains vulnerable.

The CVSS score of 9.8 indicates a severe vulnerability, but the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying limited active exploitation reports. Based on the description, the likely attack vector is local: an attacker must provide a malicious NTFS volume that the kernel mounts, typically requiring write access to a removable or otherwise accessible NTFS filesystem. Remote exploitation is unlikely because the flaw is triggered during NTFS mounting, not by network or user input. The risk is therefore primarily a local information‑disclosure concern in environments where kernel confidentiality is critical.