A bounds-validation flaw in the Linux kernel NTFS3 driver allows local attackers to achieve arbitrary code execution via a specially crafted NTFS image.

This is an improper input validation vulnerability within the NTFS3 file system driver log replay function, requiring local access and user interaction to mount a malicious file system.

A successful exploit can lead to kernel-level memory corruption, resulting in a system crash, denial of service, or complete system compromise. With a CVSS score of 7.8, the high severity rating reflects the potential for full control over the underlying operating system and the compromise of all stored data.

Immediate Action: Update the Linux kernel to version 5.15.212, 6.1.178, 6.6.145, 6.12.96, or later.

Proactive Monitoring: Monitor system logs for kernel panics, slab allocation faults, or unauthorized mounting of external NTFS storage devices.

Compensating Controls: Restrict physical access to systems and enforce strict device control policies to prevent the automatic mounting of untrusted or removable NTFS file systems.

Public Exploit Available: false

Administrators must prioritize updating affected Linux kernel packages to the latest patched versions to eliminate the risk of kernel memory corruption. Because this vulnerability is triggered during the mounting of a file system, preventing the attachment of untrusted media provides a critical secondary defense while patches are deployed.