The Linux kernel NTFS driver contains a flaw where ntfs_sync_fs clears the volume dirty flag unconditionally after a sync() operation, even if NVolErrors(vol) is true. This causes the system to believe the volume is clean and skip the automated recovery pass. Consequently, errors that should trigger a crash-consistency cleanup remain unrepaired, potentially leaving data corruption undiscovered. The weakness arises from insufficient error checking during the sync routine, causing the system state to be incorrectly reset (CWE-390).

All Linux kernel versions that incorporate the unpatched ntfs_sync_fs code are affected. The vulnerability applies to the NTFS file system module included in Linux kernels; any distribution that ships that driver without the mentioned fix is potentially impacted. No specific kernel release is identified in the CVE payload, so all kernels containing the legacy NTFS driver prior to the patch are considered vulnerable.

The CVSS score of 5.5 indicates moderate severity; the EPSS score of <1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a local user with root or elevated privileges who can mount an NTFS volume and induce errors (for example, by modifying $MFTMirr). Once errors are logged, an attacker can trigger a sync() to clear the dirty flag and avoid automatic recovery, resulting in silent data corruption rather than remote code execution. Because the flaw only impacts data integrity, the overall risk remains moderate.