The Linux kernel NTFS3 driver has an out‑of‑bounds write caused by improper bounds checking on the page_lcns array during the copy_lcns and redo loops. A crafted NTFS log record can overflow this array, corrupting kernel memory and potentially allowing an attacker with write access to the filesystem to execute privileged code or crash the system. This flaw corresponds to CWE‑787 Buffer Overflow.

All Linux kernels that ship the unpatched NTFS3 implementation are affected. The vulnerability resides in the core kernel, so every distribution that includes the current kernel code is potentially vulnerable until the patch that introduces dp_range_ok() and the bounds check is applied. No specific version numbers are listed, so any kernel prior to the commit that applies the fix is considered vulnerable.

The CVSS score of 6.7 indicates moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation. The flaw is not catalogued in the CISA KEV database, suggesting it has not yet been widely exploited in the wild. Successful exploitation would require the attacker to craft a malicious NTFS volume that the system processes, so it typically requires access to the filesystem rather than remote network access. Nevertheless, because the impact occurs in kernel space, a successful exploitation can lead to privilege escalation or a denial of service.