The vulnerability resides in the fs/ntfs3 module, where run_get_highest_vcn() processes a packed NTFS mapping‑pairs buffer without verifying its length, relying only on a null terminator. A crafted $LogFile UpdateMappingPairs record that omits the terminator causes the routine to read past the slab allocation, producing a KASAN out‑of‑bounds read at mount time. This can trigger a kernel panic or reveal parts of kernel memory, achieving denial of service and potential information disclosure.

Any Linux system that uses the Linux kernel’s native NTFS3 driver is affected, because the unpatched implementation is present in all kernel releases that have not incorporated the bound‑check commit. No specific version range is provided, so all current and older kernels that still contain the legacy ntfs3 code remain vulnerable until the patch is applied.

Based on the description, it is inferred that an adversary must provide a malicious NTFS volume containing a crafted $LogFile record to exploit the bug; thus the attack vector is local and relies on mounting the vulnerable volume. The EPSS score is below 1 %, indicating a low exploitation probability, yet it is not zero. The CVSS score of 8.4 denotes high severity. The vulnerability is not listed in CISA’s KEV catalog. While the impact is limited to a crash or memory disclosure, its automatic execution during normal mount operations makes the risk moderate to high for environments that mount untrusted NTFS filesystems.