An improper bounds check in the Linux kernel NTFS driver compares the name length in UTF-16LE characters to the size of a directory entry in bytes, ignoring the fact that each character consumes two bytes and that the entry contains a 66-byte ATTR_FILE_NAME header preceding the name. A crafted NTFS image that includes a directory entry whose byte size is smaller than the calculated size of the name causes ntfs_utf16_to_nls() to read memory beyond the end of the entry. This out-of-bounds read can expose data from adjacent memory locations and may result in a kernel crash if the corrupted data is subsequently used.

The flaw resides in the default ntfs3 driver that ships with the Linux kernel. All Linux installations that use the ntfs3 module to mount or read NTFS volumes are potentially affected, regardless of kernel version, until the driver is updated to a version that includes the corrected size calculation and the additional key_size validation.

The vulnerability is local; an attacker must supply a specially crafted NTFS filesystem that the kernel parses. The out-of-bounds read allows the kernel to access memory beyond the bounds of the targeted entry, potentially revealing kernel memory contents and possibly leading to a denial of service. EPSS data is not available and the issue is not listed in the CISA KEV catalog. No CVSS score is provided, but the severity can be considered high because it involves kernel-level memory disclosure. Because the flaw is not delivered over a network and no code execution is described, the primary risk is information disclosure and service disruption.