In the Linux kernel, when freeing clusters on an NTFS filesystem, the code incorrectly added a run’s length to the freed‑cluster counter even when the bitmap clear operation had failed, a flaw that exemplifies CWE‑253 (Incorrect Verification or Validation). This logic defect inflates the reported number of free clusters, corrupting the output of statfs and the allocator’s free‑space gate, leading to misleading filesystem statistics and the potential for the kernel’s memory allocator to misbehave, which could degrade performance or trigger a denial‑of‑service condition when incorrectly reported as available.

This bug resides in the Linux kernel’s NTFS driver. All Linux systems using an unpatched kernel that includes the ntfs_cluster_free_from_rl_nolock routine are affected. The specific kernel versions affected are those prior to the commit that introduced the fix (see references). Distributions that ship with older kernels should check whether their current releases contain the patch.

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation at this time. However, the flaw requires that the system be able to write to an NTFS volume, suggesting a local or privilege‑elevated attacker could trigger it. The CVSS score of 5.5 indicates a moderate risk. System administrators should monitor for unusual statfs output and apply the patch promptly to prevent possible denial‑of‑service conditions.