In the Linux kernel’s NTFS3 driver an out‑of‑bounds read occurs in read_log_rec_buf() when it copies a log record into a caller buffer using offsets taken from the disk restart area. The offset calculation can exceed the page boundary, causing memcpy() to read past the intended buffer and into adjacent slab memory. When an attacker mounts a crafted NTFS image, the kernel leaks kernel memory contents, potentially exposing secrets or system state.

All Linux kernel releases that include the vulnerable NTFS3 driver before the patch in the linked commit are affected. Distributions that enable NTFS support with these kernel versions are at risk, regardless of the kernel vendor or specific release number.

The CVSS score is 8.4, indicating high severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation at the time of analysis. Based on the description, it is inferred that the attacker must be able to mount a crafted NTFS image, but the privilege level required is not explicitly stated; therefore the attack vector could be local or possibly remote if the system supports mounting arbitrary NTFS images from external sources. It is not listed in the CISA KEV catalog. Although exploitation likelihood is low, the potential for kernel memory disclosure is high, warranting timely patching.