The Linux kernel contains an out‑of‑bounds read in the NTFS3 driver during parsing of the $Extend/$Reparse and $Extend/$ObjId metafiles. A crafted NTFS image can cause the kernel to read beyond the allocated buffer, potentially leaking sensitive kernel memory. This read vulnerability follows a “resident_data” call that does not validate the attribute size, allowing a zero‑length resident attribute to expose data. The impact is the disclosure of kernel data, which could reveal secrets or be leveraged for privilege escalation when combined with other kernel bugs.

The flaw exists in the Linux kernel’s NTFS3 filesystem driver. All versions of the kernel that have not applied the upstream patch up to the current stable release are affected. No specific version numbers are listed in the advisory; therefore any kernel build that includes the unpatched NTFS3 code is vulnerable.

The identified exploit path requires the attacker to have CAP_SYS_ADMIN privileges to execute the mount system call with a malicious NTFS image. Because the flaw leads only to a memory read rather than a direct code execution path, the immediate risk is the potential leakage of kernel data, which could enable privilege escalation or further exploitation. CVSS, EPSS, and KEV data are not provided, and the vulnerability is not listed in CISA’s KEV catalog. Consequently, the risk is considered moderate to high for privileged users and systems that mount untrusted NTFS volumes.