The Linux kernel’s NTFS filesystem contains an integer overflow bug in the memory allocation for runlist elements, which describe the layout of clusters on an NTFS volume. In ntfs_rl_realloc() and ntfs_rl_realloc_nofail(), a runlist element count is converted to a byte size without checking for overflow, allowing an attacker to cause an underestimated allocation size. The resulting kernel memory corruption can be used to gain elevated privileges on the local system.

All Linux kernel releases that include the vulnerable NTFS runlist reallocation code are affected. The CVE does not specify a particular kernel version, so any system running an unpatched kernel capable of reading or mounting NTFS volumes may be impacted.

The CVSS score of 9.8 marks the flaw as critical, but an EPSS score of less than 1 % indicates a very low probability of exploitation and the vulnerability is not listed in CISA’s KEV catalog. The flaw involves a simple integer overflow in kernel memory allocation; therefore, it could be exploited if an attacker can deliver a crafted NTFS volume that triggers the reallocation routine, though the exact attack vector is inferred from the description of the affected code.