A use‑after‑free occurs in the Linux ntfs driver when the MFT writeback routine and a concurrent allocation extension interleave. The driver looks up a runlist element, releases the lock, and later reuses data from that element without copying it first. If the allocation path reallocates the runlist between lookup and use, the pointer points to freed memory and the writeback can dereference it, causing a kernel panic and memory corruption. KASAN reports confirm the crash is due to a slab use‑after‑free.

All Linux kernels that include the unpatched ntfs driver are affected, which includes any mainstream kernel build prior to the commit that removed the stale pointer usage. Common distributions shipping older mainline releases or custom kernels without the patch remain vulnerable. No specific kernel version ranges were cited by the advisories, so any kernel that has not applied the mainline fix is potentially at risk.

The CVSS score of 8.8 defines the vulnerability as high severity, while the EPSS score of <1% indicates a very low yet nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. The attack vector is inferred to be local or via a compromised process that can trigger heavy NTFS I/O while a concurrent allocation occurs. Successful exploitation would result in a kernel crash, leading to a denial of service on the host and potential memory corruption. The impact escalates rapidly if not mitigated because the flaw is a kernel integrity violation.