The ntfs3 filesystem in the Linux kernel fails to handle block sizes larger than PAGE_SIZE when using buffer_heads. When a block size exceeds PAGE_SIZE, a BUG_ON is triggered during the first folio read, causing a kernel panic. This flaw arises from a potential mishandling of large input values (CWE-617), resulting in a denial of service.

The issue impacts any Linux installation that includes the ntfs3 filesystem module without the recent patch. Any kernel version prior to the update that contains ntfs3 will be vulnerable, regardless of distribution, as long as the module is loaded and an NTFS volume is accessed.

The CVSS score of 4.4 indicates low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. Exploitation would require triggering the BUG_ON by mounting an NTFS volume with an oversized block size. Based on the description, we can infer that such an operation would likely need local privileges, since mounting usually requires root. No public exploits have been reported, so the risk remains low in environments where NTFS support is unused or tightly controlled.