The vulnerability exists in the Linux kernel’s NTFS module. When a file on an NTFS volume is accessed, the kernel reads the attribute list for the inode. The function ntfs_external_attr_find() examines the next $ATTRIBUTE_LIST entry as a look‑ahead, but it only checks that the first six bytes of that entry are inside the allocated buffer. It then uses an attacker‑controlled length field that is not eight‑byte aligned to check the end of the entry, allowing the read of fields such as lowest_vcn and name that can lie past the buffer’s end. The result is a slab out‑of‑bounds read that can expose arbitrary kernel memory. This represents an information‑disclosure flaw classified as an out‑of‑bounds read (CWE‑125) and can also be seen as a failure of proper input validation (CWE‑20).

The flaw is present in any Linux kernel that includes the NTFS driver, without a specific version list provided in the advisory. The kernel code that implements ntfs_external_attr_find() was modified in the referenced patches. Users running older kernels that have not applied these changes are affected.

The vulnerability is local to the system that mounts an NTFS volume containing a maliciously crafted $ATTRIBUTE_LIST structure. An attacker could read sensitive kernel memory that may contain secrets or addresses, potentially enabling further exploitation. The CVSS score is not supplied, nor is there an EPSS value or KEV listing, but the memory disclosure nature and kernel context make it a serious risk for systems that accept NTFS media from untrusted sources.