A flaw in the Linux kernel's NTFS file system module causes the HasEA flag to be set incorrectly when a write of extended attributes fails. The flag is updated unconditionally even when the operation does not succeed, and the flag’s value is then used to hide existing on‑disk extended attributes until the inode is evicted. This results in silent, irreversible loss of attribute data rather than a clean error. The vulnerability is a state‑management issue that can lead to data integrity problems within the file system.

All Linux kernel builds that use the NTFS module and have not applied the recent patch, regardless of distribution. No specific kernel versions are listed, so any kernel before the fix is potentially affected.

The flaw can be exercised only when a privileged process writes extended attributes to an NTFS volume. The attack does not allow arbitrary code execution or remote compromise. Because it requires local privileged access and no publicly known exploit exists, the risk is moderate. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog.