The vulnerability arises when the fallocate implementation for NTFS files does not hold the invalidate_lock for standard allocation modes (mode == 0, FALLOC_FL_KEEP_SIZE). During allocation, new clusters are mapped but not immediately zeroed, creating a window in which an mmap page fault can read uninitialized or stale disk data. A process that mmap's the file can therefore read data that should have been cleared, leading to an information leak and a data integrity issue.

All Linux kernel versions that implement the NTFS filesystem are potentially affected because the race condition exists in the kernel's NTFS handling code. The vulnerability is present until a kernel patch that holds invalidate_lock for every fallocate operation is applied.

The CVSS score is not provided, but the EPSS score is missing and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed to date. The attack requires that a process perform fallocate on an NTFS file and then mmap the same file before the new data is zeroed. Because the race window is brief and the exploit relies on local kernel execution, the risk is considered moderate for systems that accept untrusted user input or run processes with elevated privileges. Monitoring for any anomalous mmap activity on NTFS volumes is recommended.