The vulnerability resides in the Linux kernel’s NTFS‑3 file system driver. During the creation of a new directory on a freshly mounted NTFS image, a race condition between the directory creation path and a concurrent mount operation can corrupt an inode’s read‑write lock. The lock’s count is under‑decremented during an unsafe unlock sequence, causing a warning and preventing subsequent inode locks. This corruption can result in deadlocks and potentially corrupt path resolution, leading to a loss of file system integrity and service availability.

All Linux kernel builds that include the NTFS‑3 driver are potentially affected. No specific version range is provided; the issue is fixed in the latest kernel releases that replace the legacy d_instantiate() call with d_instantiate_new() and remove unnecessary unlock calls.

The bug can only be triggered in a local context where a user can perform both a directory creation and a mount operation on the same NTFS volume. Based on the description, it is inferred that the attack vector is local and requires privileged mount access (CAP_SYS_ADMIN or root). Typical mitigation requires such privilege. No publicly known exploits or exploits in the wild are documented, and the EPSS score is < 1%; the CVSS score of 5.5 indicates moderate risk. The risk level remains moderate to high for systems that expose untrusted NTFS content to privileged users. The Kernel Integrity Vulnerability (KEV) list does not currently include this issue, and the vendor's fix provides complete remediation.