An incorrect bounds check in the Linux kernel’s NTFS driver compares a UTF‑16LE filename length, measured in characters, to a length field expressed in bytes, ignoring the double‑byte character size and the 66‑byte header that precedes the name. When a malicious NTFS image supplies an entry whose byte size is smaller than the miscalculated name length, the driver performs an out‑of‑bounds read during ntfs_utf16_to_nls() and can expose content beyond the intended entry boundary. The fix replaces the faulty calculation with the correct size check and adds key_size validation to prevent similar boundary violations on the lookup path.

The flaw resides in the generic ntfs3 driver that ships with the Linux kernel. All Linux systems that load this driver to mount or read NTFS volumes are potentially affected until they upgrade to a kernel version containing the corrected size check and header validation.

The vulnerability requires local access: an attacker must provide a specially crafted NTFS filesystem to the kernel, such as by mounting an infected volume or during boot. The CVSS score of 7.1 indicates high severity, and the EPSS score of < 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog. The eventual impact is limited to information disclosure of kernel memory; there is no evidence of remote code execution or guaranteed denial of service.