When the NTFS3 driver mounts a volume, it allocates a scratch buffer for log page reads using the host's page size. If the on‑disk log page size is larger than the buffer originally allocated, the driver later increases its internal page size while leaving the buffer size unchanged. A subsequent log read writes the larger page into the undersized buffer, corrupting kernel memory. This reduces the integrity of the kernel and could lead to application crashes; the description does not state privilege escalation or other impacts.

Linux kernels that include the ntfs3 driver with the original log buffer allocation logic. Any kernel version before the patch that added dynamic resizing of the one_page_buf is affected; specific kernel versions are not listed in the input.

The vulnerability is exploitable when a user mounts a dirty NTFS volume whose log was formatted with a larger page size than the buffer allocated on the host (for example, a 64 K log mounted on a machine allocating a 4 K scratch buffer). An attacker with licence to mount the volume can trigger the overflow by simply mounting such a volume. The EPSS score is < 1 %, indicating very low observed exploitation probability. The CVSS score of 7.8 classifies the flaw as high severity, and it is not listed in the CISA KEV catalog.