The Linux kernel’s NTFS driver parses the boot sector of NTFS volumes and uses the sectors_per_cluster field to compute the size of a cluster. The old implementation performed a narrow range test that incorrectly accepted a zero value. When sectors_per_cluster is zero, the ffs(0) call returns 0, causing the calculated bit shift to overflow and become a very large, undefined value. This shift out-of-bounds can corrupt memory or crash the kernel, opening the door for an attacker to execute arbitrary code with kernel privileges. The vulnerability therefore has the potential to allow remote code execution once an attacker mounts a malicious NTFS volume or otherwise triggers the parsing of a malformed boot sector.

The affected product is the Linux kernel. Specific kernel versions are not listed in the provided data, but the vulnerability notes that it resides in support. Systems running the unpatched kernel are susceptible when an NTFS volume with an invalid sectors_per_cluster field is processed.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided, but the bug occurs in kernel space and allows potential arbitrary code execution, indicating a high severity. An attacker would need to provide a crafted NTFS volume—this typically requires local access or the ability to mount a volume via an untrusted process. Once the malformed boot sector is parsed, the under‑flowing shift can lead to a kernel crash or privilege escalation. The lack of publicly available fix guidance in the advisory suggests that exploitation risk is significant for exposed systems but remains contingent on the attacker’s ability to influence volume parsing.