A race condition in the Linux kernel’s NTFS driver allows concurrent write operations and truncate/fallocate calls to manipulate the page cache without proper serialization. This can result in corrupted disk data or kernel crashes when the filesystem mapping is invalidated while new data is being written. The flaw stems from ntfs_filemap_page_mkwrite() invoking iomap_page_mkwrite() without holding mapping->invalidate_lock, violating the locking contract described in Documentation/filesystems/locking.rst. As a consequence, the runlist and page cache can be left in an inconsistent state, compromising data integrity. This vulnerability is a typical concurrency issue that can lead to subtle, hard‑to‑detect corruption. No evidence exists that the flaw can be triggered remotely; it is believed to require local access to initiate overlapping write and truncate operations. Affected systems are Linux kernel builds that include the NTFS driver without the applied patch. The specific affected versions are not listed in the input, but all kernels prior to the fix commit are vulnerable. Users running Linux distributions that ship a kernel with the unpatched NTFS module, especially when mounting NTFS partitions for read/write access, are exposed. Risk and exploitability are not quantified in the CVSS or EPSS metrics, and the flaw is not listed in CISA’s KEV catalog. The BECAUSE of race condition, any local process with permission to perform write or truncate operations on a mounted NTFS partition can trigger corruption. The lack of an explicit exploit count or public proof of concept means the likelihood of exploitation is uncertain, but the potential impact on system reliability and data confidentiality is high if the race occurs. The CVE is best mitigated by applying the appropriate kernel update.

The vulnerability affects Linux systems that run an unpatched Linux kernel with the NTFS file system driver. The list of affected products is limited to the Linux kernel itself; specific vendor or distribution names are not provided, but any distribution shipping a kernel prior to the patched commit is potentially susceptible. Users who mount NTFS partitions for regular read/write operations are at risk.

The absence of CVSS, EPSS, and KEV data suggests that the flaw has not yet been widely quantified or exploited in the wild. Nonetheless, the race condition represents a serious risk because it can corrupt data tables or crash the kernel, leading to denial of service or unauthorized data modification. Attackers with local privileges who can issue coordinated truncate/fallocate and page write operations could trigger the flaw; remote exploitation is unlikely without local access.