In the Linux kernel's NTFS driver, the sync_fs routine clears the filesystem dirty flag unconditionally after any sync operation, even when previous errors have been logged. Because error conditions are recorded, the normal recovery routine is bypassed and the volume remains unrepaired. A system or attacker that induces errors on a mounted NTFS volume can therefore cause the volume to be marked clean and lose any chance for automatic repair, potentially leaving data corruption undetected.

The vulnerability affects the Linux kernel, specifically the NTFS filesystem module. No particular kernel release version is specified in the advisory, so any kernel containing the unpatched ntfs_sync_fs code could be impacted. Vendor vendors are Linux distributions that ship the default kernel.

The CVSS score and EPSS probability are not disclosed in the advisory and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires local privileged or root access to a system that mounts NTFS volumes; an attacker could intentionally generate errors on a volume and then trigger a sync to hide the error. Because the flaw results in unrecovered corruption rather than classic remote code execution, the exploitation risk is moderate, with a focus on data integrity loss rather than immediate privilege escalation.