The NULL pointer dereference in the Linux kernel NTFS3 driver occurs when a corrupted NTFS3 image toggles system.ntfs_attrib and then overwrites system.dos_attrib on the same file, clearing the compression bit without properly updating ATTR_DATA and leaving a NULL write_begin callback. The resulting NULL function pointer call in generic_perform_write triggers a kernel Oops and a system crash that halts all processes, providing a classic denial of service scenario.

All Linux kernel releases that include the pre‑fix NTFS3 implementation are vulnerable. Any kernel that contains the bug before the commit that adds the fix (2de91ae2) is affected, regardless of distribution. The vulnerability is present only in the NTFS3 filesystem driver bundled with the Linux kernel.

The advisory does not provide a CVSS or EPSS score, and it is not listed in the CISA KEV catalog. The flaw can be triggered by a malformed NTFS3 image that is mounted or otherwise read by the kernel. Because the triggered code path is executed during a write operation, the attack vector appears to be local or requires influence over the NTFS3 file system image. While the likelihood of exploitation in real traffic is uncertain, the available information indicates a single corrupted file can crash the kernel, affecting all users on the system.