The Linux kernel’s NTFS driver incorrectly processed attributes that contained empty mapping pairs when the highest VCN and size did not match. Because the driver failed to reject such malformed attributes, an attacker could craft an NTFS volume that, when mounted, would cause the kernel to misinterpret the attribute, potentially leading to erroneous data reads or kernel crashes during volume access. The flaw is a classic instance of input validation weakness listed under CWE-130.

Any Linux kernel release running the NTFS module prior to the applied patch is potentially affected. The advisory lists a generic Linux kernel product with no version‑specific restrictions, implying that the issue exists in all kernels that have not yet incorporated the NTFS fix.

The vulnerability carries a CVSS score of 4.4, indicating a low‑to‑moderate severity. The EPSS score is below 1% and the issue is not present in the CISA KEV catalog, suggesting a low likelihood of known exploitation. The attack path appears straightforward: mount an NTFS volume containing crafted attributes with empty mapping pairs and inconsistent highest VCN and size, provoking the kernel to process them incorrectly. No publicly available exploits are reported.