A critical stack overflow vulnerability in the Linux kernel NTFS3 filesystem driver can lead to system crashes or potential code execution when processing malicious NTFS media.

The indx_find_buffer function in the NTFS3 filesystem driver lacks recursion depth limits, allowing an unauthenticated attacker to trigger unbounded recursion and kernel stack overflow by mounting a malicious NTFS filesystem and performing file deletion operations.

The vulnerability carries a CVSS score of 9.8, reflecting its potential for severe impact on system stability and availability. Successful exploitation results in a kernel panic, causing immediate denial of service for the affected host. In environments where untrusted storage media is frequently mounted, this presents a significant risk to operational uptime and service reliability.

Immediate Action: Update the Linux kernel to version 5.15.212, 6.1.178, 6.6.145, 6.12.97, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops messages or unexpected reboots associated with filesystem operations, particularly when removable media is attached.

Compensating Controls: Disable the automatic mounting of removable media and restrict the loading of the ntfs3 kernel module on systems that do not require NTFS support.

Public Exploit Available: No

Given the critical severity and the potential for kernel-level impact, administrators should prioritize patching the Linux kernel across all affected environments. If patching cannot be performed immediately, restricting the ability of unprivileged users to mount filesystems or load the ntfs3 module is a necessary step to mitigate the risk of exploitation.