The Linux kernel implements NTFS support. During the mounting of an NTFS filesystem, the function ntfs_read_inode_mount() traverses the $MFT attribute list. A maliciously crafted attribute that satisfies a basic length check but has a length field smaller than the header can cause the kernel to read memory past the end of the allocated buffer. This out‑of‑bounds read occurs before any user‑space data is processed and can leak kernel or system information or crash the kernel.

All Linux kernel versions that include the unpatched ntfs_read_inode_mount() code are affected. The flaw is present in the upstream kernel prior to the patch that validates attribute‑list entries. Systems that mount NTFS partitions from untrusted media are at risk. The issue does not appear in custom kernel builds that applied the patch.

The flaw presents a local privilege escalation vector that requires root privileges to mount the partition. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The CVSS is not supplied, but an out‑of‑bounds read that can expose arbitrary memory or cause a crash is considered high severity. An attacker with local or remote access to the machine can craft a malicious NTFS volume, then request the kernel to mount it, resulting in information disclosure or denial of service.