The vulnerability originates from the msfs/ntfs3 module where run_get_highest_vcn() parses a packed NTFS mapping‑pairs buffer without verifying its length, relying solely on a 0x00 terminator. A crafted $LogFile UpdateMappingPairs record that omits the terminator causes the routine to read past the slab allocation, leading to a KASAN slab‑out‑of‑bounds read on mount. The kernel crash or exposed sensitive memory can result in denial of service or potential information disclosure, but the current patch only mitigates the read rather than enabling arbitrary code execution.

Any Linux system that uses the Linux kernel’s native NTFS3 driver is affected. The issue affects all kernel releases that include the unpatched ntfs3 code; no specific version range is listed, so all current and older kernels using NTFS3 remain vulnerable until the patch is applied.

The exploit requires the attacker to supply a malicious NTFS volume containing a specially crafted $LogFile record. The attack vector is local: the attacker must be able to create or control the NTFS volume that will be mounted. As no public exploit exists, the EPSS score is not available and the CVE is not listed in CISA’s KEV catalog. Nonetheless, the severity is significant because the bug can cause a kernel panic or reveal kernel memory, and it is triggered automatically during normal mount operations on affected volumes. Overall risk is moderate to high for environments that mount untrusted NTFS filesystems.