The vulnerability involves the NTFS filesystem driver in the Linux kernel failing to acquire the required runlist write lock while freeing clusters and truncating the runlist. This lack of synchronization creates a race condition that can allow concurrent filesystem operations to interleave improperly, potentially leading to corrupted runlists and incorrect on‑disk mappings. The result is loss of data integrity, possible filesystem corruption, and a denial‑of‑service condition if the kernel observes an unrecoverable error state.

All Linux distributions that include the kernel NTFS driver. The vulnerability applies to any Linux kernel that has enabled ntfs support before the patches referenced by commit IDs 7427974 and 91709b7. Precise upstream version information is not supplied, so any kernel build prior to the inclusion of these commits is considered affected.

EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploitation yet. The CVSS score of 7.8 indicates high severity. The risk in a kernel driver that handles NTFS volumes, which are typically accessed locally. Based on the description, it is inferred that an attacker would need to mount a specially crafted NTFS volume or have physical access to manipulate the filesystem so that concurrent operations execute during a free or truncate. Absent a public exploit, the likelihood is low, but the impact if triggered can be severe.