The Linux kernel’s NTFS driver contains a flaw where it resizes a non‑resident attribute record before moving the attribute payload. This order causes a memmove to copy bytes from an adjacent attribute into the old mapping‑pairs area. If an empty file later re‑enables compression, the driver writes these corrupted bytes as a malformed mapping‑pairs array, which ntfsck reports as an invalid run length. The effect is corrupted file‑system metadata that can lead to data loss or system instability.

All installations of the Linux kernel that include the default NTFS driver are potentially affected. The advisory does not specify a precise kernel version range, implying the issue can exist in any release prior to the commit that reverses the resize‑before‑move ordering. Linux distributions should verify whether their shipped kernels contain that commit and upgrade accordingly.

The CVSS score is not published and the EPSS value is unavailable, so the exact exploitation probability is unknown. The vulnerability is logged as a memory‑corruption flaw and is not listed in the CISA KEV catalog. It is a local issue that requires interaction with the NTFS driver via filesystem operations, so the likely attack vector is local, possibly through crafted NTFS files that manipulate compression or sparse state. While no proof of exploitation has been reported, the potential for data corruption and loss warrants careful attention.