A critical out-of-bounds memory read vulnerability in the Linux kernel NTFS driver could allow an unauthenticated attacker to trigger system instability or potentially leak sensitive kernel memory.

The vulnerability exists within the ntfs_mapping_pairs_decompress function due to incorrect bounds checking when processing NTFS attribute records. An unauthenticated attacker can exploit this off-by-one error to perform an out-of-bounds read, potentially leading to unauthorized information disclosure or a kernel panic.

The CVSS score of 9.8 indicates a critical severity level, reflecting the potential for full system compromise. Successful exploitation could result in the disclosure of sensitive kernel memory contents, leading to a loss of confidentiality, or cause a denial of service through kernel crashes, resulting in significant operational downtime for affected systems.

Immediate Action: Update the Linux kernel to version 7.1.5 or later to incorporate the necessary bounds check corrections.

Proactive Monitoring: Monitor system logs for kernel-related errors, specifically those indicating memory access violations or unexpected process terminations related to filesystem operations.

Compensating Controls: Restrict access to NTFS-formatted media and ensure that only trusted sources are mounted on critical infrastructure to mitigate the risk of processing malicious NTFS attributes.

Public Exploit Available: Unknown

Given the critical CVSS score and the fundamental nature of the Linux kernel, immediate patching is required to prevent potential exploitation. Administrators should prioritize updating systems that utilize the NTFS driver for external or untrusted storage media to the latest stable release.