A vulnerability in the Linux kernel NTFS3 driver could allow an unauthenticated attacker to leak sensitive kernel memory to userspace through crafted file decompression.

The vulnerability exists in the ni_read_frame function within the NTFS3 file system driver, where the kernel fails to properly initialize memory when LZNT decompression results in partial data. An unauthenticated attacker can trigger this by providing a crafted compressed file, causing the kernel to return uninitialized memory to userspace.

This vulnerability presents a high risk because it allows for the unauthorized disclosure of sensitive kernel memory. Such data leakage can expose cryptographic keys, credentials, or other internal system structures that could facilitate further exploitation or compromise system confidentiality. While the CVSS score is 7.5, the potential for kernel-level memory disclosure warrants immediate attention to prevent privilege escalation or data theft.

Immediate Action: Update the Linux kernel to the latest stable release, ensuring at least version 5.15.221, 6.1.188, 6.6.157, or 6.12.109 is applied.

Proactive Monitoring: Monitor system logs for unusual file access patterns or error messages related to NTFS file system operations that might indicate attempts to trigger decompression failures.

Compensating Controls: Restrict the ability to mount untrusted or external NTFS volumes on critical systems to prevent attackers from introducing the malicious files required to trigger the vulnerability.

Public Exploit Available: Unknown

The Linux kernel NTFS3 driver vulnerability poses a significant risk of kernel memory exposure. Administrators should prioritize patching their kernels to the specified fixed versions. If immediate updates are not feasible, restrict the handling of external or untrusted NTFS-formatted media to mitigate the risk of exploitation until patches can be deployed.