In the Linux kernel ntfs subsystem, the mapping pairs decoder verifies only the starting LCN of a file run, but does not ensure that the length of the run stays within the bounds of the volume. A malicious NTFS image can embed a mapping pair with an excessively long run, causing the kernel to read or write memory beyond the end of the volume. This memory corruption can compromise kernel integrity and provide an attacker with the ability to elevate privileges to root level.

Every Linux kernel build that includes the ntfs mapping decoder without the added boundary check, which is the default state in upstream kernels prior to the included commits. All deployments using such kernels – across major distributions and custom builds – are susceptible when the kernel mounts or processes a malicious NTFS filesystem.

The CVSS score of 7.0 indicates a high impact; the EPSS score of under 1% reflects a low probability of real‑world exploitation. No public exploit has been disclosed, and the vulnerability is not tracked in CISA's KEV catalog. Attackers would need to provide a specially crafted NTFS volume, commonly via removable media or a controllable remote file system mount. The exploit would trigger when the kernel decodes the offending mapping pair, leading to memory corruption and potential privilege escalation.