The vulnerability resides in the Linux kernel NTFS filesystem driver. An unvalidated resident attribute list is copied into kernel memory without sanity checks, allowing a crafted list to trigger out-of-bounds reads when internal functions iterate over the list. This can expose kernel memory contents, potentially leaking sensitive data and enabling further privilege-escalation exploits. The flaw is a classic buffer over-read, classified under CWE-126 and improper input validation, CWE-20.

All Linux kernel builds that include the older NTFS driver are potentially impacted, including recent releases that have not yet incorporated the fix. Kernel versions containing the legacy ntfs.c module are affected prior to the commits referenced in the advisory. Vendors should update to a kernel revision that incorporates commit 55e97648f7753c6097cb682d24d1abcfe878e812 or the equivalent patch. There are no reported version constraints beyond the presence of the NTFS module.

Because the CVSS score is not publicly disclosed, risk must be inferred from the nature of the defect. The lack of EPSS data and the absence from the KEV catalog suggest no known active exploitation at present. Nevertheless, the kernel-level memory leak could provide an attacker with privileged information, especially in a local execution context or when an attacker controls NTFS mounts. Attacks would likely require local access to create a malicious NTFS volume or to manipulate a pre‑mounted one. The vulnerability is therefore moderate to high in potential impact but lower in immediate exploitability without additional foothold.