In the Linux kernel, when freeing clusters on an NTFS filesystem, the code incorrectly added a run’s length to the freed‑cluster counter even when the bitmap clear operation had failed. This logic flaw inflated the reported number of free clusters, corrupting the output of statfs and the allocator’s free‑space gate. The result is misleading filesystem statistics and the potential for the kernel’s memory allocator to misbehave, which could degrade performance or lead to a denial of service when is incorrectly reported as available.

This bug resides in the Linux kernel’s NTFS driver. All Linux systems using an unpatched kernel that includes the ntfs_cluster_free_from_rl_nolock routine are affected. The specific kernel versions affected are those prior to the commit that introduced the fix (see references). Distributions that ship with older kernels should check whether their current releases contain the patch.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation at this time. However, the flaw requires that the system be able to write to an NTFS volume, suggesting a local or privilege‑elevated attacker could trigger it. While the CVSS score is not provided, the integrity impact on filesystem statistics and potential allocator corruption imply a moderate risk. System administrators should monitor for unusual statfs output and consider the patch a priority to prevent possible denial‑of‑service conditions.