The kernel routine that handles file allocation on NTFS files can dereference a pointer to a runlist element that has already been freed. This use‑after‑free flaw is triggered by a race between a concurrent fallocate operation and a write‑back path that reallocates the runlist after the read lock is released. The corrupted memory access can cause kernel panic, memory corruption, or provide a foothold for privilege escalation by an attacker that can influence the race. The weakness is categorized as CWE‑825: Use‑After‑Free.

All Linux kernel releases that include the NTFS driver are impacted until the runlist snapshot fix is merged. The advisory does not list specific kernel versions, so any kernel prior to the correction remains vulnerable. Systems mounting NTFS volumes or using the NTFS driver expose the file allocation and mmap paths where the fault can occur.

The CVSS score of 8.8 reflects high confidentiality and integrity impact in an elevated privilege context. The EPSS score is < 1 %, indicating a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The attack requires a local race condition between fallocate and mmap on the same NTFS file, so the vector is inferred to be local and would typically require the attacker to have write access to an NTFS‑mounted volume. Once the race succeeds, kernel memory corruption can lead to denial of service or privilege escalation, but nothing in the advisory indicates a publicly available exploit; the risk is mainly theoretical with an uncommon exploitation scenario.