The kernel's ntfs3 filesystem driver can produce an uninitialized logical cluster number when a requested VCN is not found in the run table. The failure propagates a NULL lcn into attr_data_get_block_locked, leaving an internal variable uninitialized. This lack of initialization can cause a kernel panic or leak sensitive kernel memory contents. This represents an instance of improper initialization (CWE-908).

All Linux systems that ship with the built‑in ntfs3 module are affected, regardless of the distribution, as long as the kernel has not applied the commit that resolves the issue. The flaw surfaces whenever an NTFS volume containing a missing VCN is accessed or a seek operation is performed.

The vulnerability carries a CVSS score of 7.1, indicating high severity. The EPSS score is <1% and the issue is not listed in CISA's KEV catalog, suggesting exploitation potential is low but not negligible. The most likely attack vector involves local or privilege escalation by a user who can mount an NTFS volume, triggering the defect during normal read or seek calls.