The Linux kernel's NTFS3 filesystem driver contains a flaw that fails to mark an inode as bad when a rename operation does not succeed. The kernel continues to use the inode without detecting the error, and the subsequent WARN_ON macro does not prevent further operations on the inconsistent data structure. This improper error handling can lead to corruption of NTFS partitions or loss of data when files are read, written, or modified after a failed rename.

All Linux kernel releases that ship the NTFS3 driver before commit 519b078998ce are impacted. Any distribution using a kernel version that has not incorporated this commit remains vulnerable. Systems that mount NTFS partitions and allow rename operations on them are at risk, regardless of the distribution or kernel patch level.

The likely attack vector is local, requiring that an attacker can initiate a rename operation on files within an NTFS partition that the kernel is mounting. The EPSS score of < 1% indicates a low probability of exploitation, and the bug is not listed in the CISA KEV catalog. However, the CVSS score of 9.8 denotes critical severity, and the flaw can cause kernel warnings, OOPS messages, or severe filesystem degradation if an attacker repeatedly triggers failed renames. The lack of proper bad‑inode handling may also enable additional malicious actions through corrupted metadata.