The bug in the Linux kernel’s NTFS driver causes a mismatch between the index root header and the actual resident value size after a reparent operation. The code publishes an inflated index length before confirming the allocation succeeds, creating a transient state in which the header claims more space than the resident data provides. When lookup logic later validates the $INDEX_ROOT structure, it rejects the layout as corrupt, and the recovery path may attempt to rebuild attribute lists, potentially causing application crashes or filesystem corruption.

Any Linux kernel that still contains the buggy ntfs module—i.e., kernel versions prior to the patch—is affected. The vulnerability is limited to the kernel’s NTFS support; it does not affect user‑land utilities or other filesystems. Systems that mount NTFS volumes with the default ntfs module are therefore at risk, regardless of distribution.

The CVSS score of 9.8 indicates critical severity, while the EPSS score is reported as less than 1 %, indicating a very low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the flaw requires a resident NTFS volume and local filesystem access to trigger the recovery path; an attacker must therefore have physical or local access to the affected host. The severity is high in terms of potential data loss, but the probability of successful exploitation remains low under normal circumstances.