The flaw resides in the ntfs3 file‑system driver, where the function ntfs_read_ea does not verify that the extended attribute record size (ef->size) is large enough to hold its name and value fields. As a result, a crafted NTFS image can supply an elength that is much larger than ef->size, causing ntfs_get_ea to read past the end of the allocated buffer and leak kernel heap memory to userspace via the getx attribute function, which is an information‑disclosure vulnerability potentially exposing sensitive data.

Affected systems are Linux kernel implementations that include the ntfs3 driver. The vendor is Linux and the product is the Linux kernel. No specific release numbers are listed in the CNA data, indicating that any kernel version prior to the patch is potentially vulnerable.

The CVSS score is 9.1, indicating a high risk but the EPSS score of < 1% suggests a low probability of exploitation in the wild. The flaw requires local access to an NTFS volume that contains the vulnerable extended attribute record; thus the exploitation scenario typically involves a user with physical or removable media access mounting the crafted filesystem. Because it allows read‑only access to kernel heap memory without modifying memory contents, it is classified as an information‑disclosure vulnerability rather than a code‑execution flaw, but it still poses a significant risk if sensitive data is present in the leaked memory.