The Linux kernel’s NTFS driver contains a defect in the ntfs_set_ea function: when a write of an extended attribute fails before the internal size counter is updated, the routine updates the HasEA flag based on an uninitialized value. This causes the kernel to believe the inode has no extended attributes and hides any existing on‑disk EAs until the inode is evicted, potentially resulting in irreversible data loss.

Any Linux kernel that includes the NTFS module and has not applied the recent fix is vulnerable. This includes the 7.3 RC1 firmware and all earlier stable kernels that expose the ntfs_set_ea code path.

With a CVSS score of 5.5 the severity is moderate, and the EPSS score of less than 1 % implies a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a user who has permission to invoke setxattr on a file residing on an NTFS volume; exploitation would hide or lose the extended attribute data for the affected inode.