The Linux kernel's NTFS3 filesystem driver failed to mark an inode as bad when a rename operation failed, leaving the inode in an inconsistent state. This oversight caused the WARN_ON macro to trigger without protecting the inode from further use, potentially allowing read or write operations on an invalid inode. Such improper error handling can lead to filesystem corruption or loss of data on NTFS partitions mounted in Linux. The weakness stems from incorrect handling of error conditions in the filesystem driver, a classic denial‑of‑service or data‑corruption scenario.

All Linux kernel releases that include an NTFS3 driver and that are susceptible to the described bug. The patch that fixes the issue is contained in commit 519b078998ce and later releases of the kernel. Users of any Linux distribution running a kernel version prior to these commits are affected.

The vulnerability is local; an attacker must be able to trigger a rename operation on an NTFS partition that the kernel is managing. There is no publicly available exploit code and the EPSS score is not reported, meaning we lack a quantified exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can trigger a kernel warning and compromise filesystem integrity, it remains a high‑severity risk for systems exposing NTFS mounts to untrusted users or processes. The risk is mitigated only by applying the kernel patch that replaces the insecure WARN_ON with a proper call to _ntfs_bad_inode()