Technical impact
The Linux kernel NTFS implementation fails to propagate an error from a reparse index insertion routine, causing the system to return success despite the reparse data never being written to disk. Functions such as symlink(2) or Windows Subsystem for Linux file creation thus report a 0 return code while the file effectively does not exist. This unchecked error condition, the failure to perform required security checks, and the failure to handle error return codes (CWE-252) allow an attacker or misled user to assume the presence of a file or the success of an operation that is in fact incomplete.
Affected Systems
All Linux kernel builds that include NTFS filesystem support are potentially impacted. Because a generic CPE identifier indicates Linux kernel, no specific vulnerable versions are listed. Administrators should treat every kernel variant that ships with NTFS support as susceptible until a corrective update is applied.
Risk and Exploitability
The CVSS score of 5.5 and EPSS score < 1% provide a moderate quantitative severity estimate. The flaw is limited to kernel interactions with NTFS mounts or the WSL environment and merely results in a false success signal; it does not provide remote code execution or privilege escalation. Consequently, the immediate threat is moderate, yet the inaccurate status can mislead troubleshooting or facilitate subtle misconfigurations. No exploitation of the flaw has been documented, and it is not listed in the CISA KEV catalog.
