In the Linux kernel’s NTFS3 filesystem implementation, a validation function that checks directory page entries lcns_follow array embedded in each DIR_PAGE_ENTRY. A value crafted in the on‑disk lcns_follow field can cause the memmove during a v the end of the entry. This out‑of‑bounds write corrupts kernel memory, potentially allowing an attacker to execute arbitrary code, crash the system, or elevate privileges.

The flaw resides in the core ntfs3 module of the Linux kernel, so any distribution that ships with the kernel and mounts NTFS3 filesystems is potentially affected. Because the CVE does not list specific kernel releases, all unpatched kernels that include the ntfs3 filesystem code are at risk.

The CVSS score of 6.4 indicates a moderately high severity. The EPSS score is less than 1% (0.00175), reflecting a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is local: an attacker who can write to an NTFS3 volume can create a malicious log entry replay. The attack requires the NTFS3 module to be loaded and a mounted NTFS volume; it does not depend on a network interface. Because the vulnerability leads to memory corruption at kernel level, a successful exploit could compromise confidentiality, integrity, or availability of the host.