A critical vulnerability in the Linux kernel NTFS driver allows an unauthenticated attacker to cause system instability or potential code execution through a malformed filesystem image.

The vulnerability exists within the NTFS filesystem driver, which fails to reject invalid empty mapping pairs when they contain inconsistent highest VCN and size values. An unauthenticated attacker can exploit this by providing a maliciously crafted NTFS image to a system that mounts it, triggering the flaw.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to system availability and integrity. A successful exploit could lead to a kernel panic or potentially allow an attacker to gain unauthorized control over the affected host, resulting in significant data compromise or total system failure.

Immediate Action: Update the Linux kernel to version 7.2.4 or later to apply the necessary validation checks for NTFS mapping pairs.

Proactive Monitoring: Monitor system logs for kernel-level errors or crashes associated with filesystem mounting operations, which may indicate attempted exploitation.

Compensating Controls: Restrict the ability to mount external or untrusted storage media on critical infrastructure, as the vulnerability requires the parsing of a malicious NTFS image.

Public Exploit Available: No

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize patching the Linux kernel across all affected environments. Implementing strict controls over the mounting of external media is advised until the updates can be fully deployed to mitigate the risk of unauthorized filesystem parsing.