A high-severity memory corruption vulnerability in the Linux kernel NTFS3 driver could allow a local attacker with low privileges to trigger an out-of-bounds memory access, leading to system compromise.

The vulnerability exists in the NTFS3 filesystem log replay mechanism, where the kernel fails to validate the length of the page_lcns array within a DIR_PAGE_ENTRY structure. An attacker can supply a crafted lcns_follow field to bypass bounds checks, resulting in a memory overflow during log processing; this requires local access and low privileges (PR:L).

The CVSS score of 7.8 reflects the high potential for impact on confidentiality, integrity, and availability. Successful exploitation allows a local user to corrupt kernel memory, which can lead to privilege escalation, arbitrary code execution within the kernel context, or a complete system crash (Denial of Service). This poses a significant risk to the stability and security of systems hosting sensitive data or performing critical infrastructure tasks.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or filesystem-related errors that occur during mount operations or log recovery tasks.

Compensating Controls: If patching is delayed, restrict access to mounting NTFS filesystems to trusted users only and consider disabling the NTFS3 driver if it is not strictly required for business operations.

Public Exploit Available: No.

Given the severity of potential kernel-level exploitation, organizations must prioritize patching the Linux kernel across all affected environments. While the attack requires local access, the risk of privilege escalation makes this a high-priority update. Administrators should verify their kernel version and apply the upstream fixes or distribution-provided security patches immediately.