Technical impact
In the Linux kernel, a missing validation for the name_offset field in NTFS non‑resident attributes allows a crafted NTFS Master File Table record to write past the end of the attribute or overlap mapping pairs during conversion. This can corrupt kernel memory and potentially lead to denial‑of‑service or arbitrary code execution if the attacker can execute the corrupted code path. The flaw arises from improper bounds checking of name_offset when converting between non‑sparse and sparse attributes, exposing a classic buffer‑overwrite vulnerability (CWE‑787).
Affected Systems
The vulnerability affects the Linux kernel; the specific kernel, so any kernel containing the unpatched ntfs_attr_update_meta implementation is susceptible.
Risk and Exploitability
The CVSS score of 9.8 indicates a high severity vulnerability. The EPSS score is < 1%, pointing to a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires local access to create or modify a malicious NTFS file or disk image that the kernel processes; remote exploitation is unlikely unless a service exposes the NTFS parser. If an attacker can influence the MFT record read by the kernel, exploitation could lead to memory corruption and a subsequent crash or further compromise with elevated privileges.
