A critical out-of-bounds read vulnerability in the Linux kernel NTFS driver allows an unauthenticated attacker to potentially trigger system crashes or disclose sensitive memory contents.

The vulnerability resides in the ntfs_external_attr_find function, where the kernel fails to properly validate the bounds of attribute-list entries during a lookup. An attacker can supply a crafted on-disk attribute list to cause an out-of-bounds read, as the kernel dereferences memory beyond the allocated buffer.

This vulnerability carries a CVSS score of 9.8, reflecting its critical nature. Because the NTFS driver is a fundamental component of filesystem handling, a successful exploit could lead to full system compromise, including unauthorized access to sensitive data or a complete denial of service through kernel panic. The lack of required authentication makes this flaw particularly dangerous for any system that processes untrusted NTFS volumes.

Immediate Action: Update the Linux kernel to version 7.1.5 or later, or apply the upstream patches provided in the kernel source repository commits 44885c9b45eb4082fb7f558590d84bb254a08e94 or 344b18f389f9934d59c7b0cf3d20541ea2e0da58.

Proactive Monitoring: Monitor system logs for unexpected kernel oops or panic events, specifically those related to NTFS filesystem activity.

Compensating Controls: Restrict the ability to mount external or untrusted storage volumes on production systems where the NTFS filesystem driver is active.

Public Exploit Available: No

Given the critical severity of this kernel-level vulnerability, administrators should prioritize patching the Linux kernel across all affected environments. Unpatched systems remain at high risk of exploitation if they process external NTFS-formatted drives. Please coordinate with your kernel maintainers to integrate the provided patches into your distribution's build pipeline immediately.