A vulnerability in the Linux kernel NTFS3 driver could allow a local attacker to cause an out-of-bounds read, potentially leading to system instability or information disclosure.

This is an out-of-bounds read vulnerability caused by a lack of index bounds validation within the decompress_lznt function when processing NTFS3 compressed data. An attacker with local access, specifically the ability to mount or interact with a corrupted NTFS3 image, can trigger this condition.

While the CVSS score of 7.8 indicates a high severity rating, the requirement for local access and a specifically crafted filesystem limits the attack surface. Successful exploitation could result in a kernel panic, leading to denial of service, or the disclosure of sensitive memory contents, potentially impacting the confidentiality and integrity of the affected host.

Immediate Action: Update the Linux kernel to version 5.15.212, 6.1.178, 6.6.145, 6.12.97, or a later stable release provided by your distribution.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults related to the NTFS3 module, which may indicate attempted exploitation or filesystem corruption.

Compensating Controls: If patching is not immediately feasible, restrict the ability to mount external or untrusted NTFS3 filesystems on sensitive systems.

Public Exploit Available: Unknown

Given the potential for system instability and information disclosure, administrators should prioritize updating the Linux kernel to the versions specified above. Ensure that all production environments are running patched kernels, particularly those that frequently interact with external storage media or untrusted NTFS3 volumes.