A critical out-of-bounds read vulnerability in the Linux kernel NTFS3 filesystem driver could allow an unprivileged local attacker to trigger memory corruption and potential system instability.

The flaw occurs in the read_log_rec_buf function of the NTFS3 driver, where insufficient validation of on-disk restart area data leads to an integer underflow and subsequent heap-based out-of-bounds read. This vulnerability can be triggered by an unauthenticated local user mounting a specially crafted NTFS filesystem image.

The exploitation of this vulnerability can result in kernel-level memory corruption, which typically leads to an immediate system crash (Denial of Service). Furthermore, the ability to read adjacent slab memory may facilitate the leakage of sensitive kernel data, undermining system confidentiality and integrity. Given the CVSS score of 8.4, this issue is considered high severity due to the potential for local escalation of privileges or complete system compromise.

Immediate Action: Update the Linux kernel to version 5.15.221, 6.1.188, 6.6.157, 6.12.110, or newer, depending on your distribution's supported branch.

Proactive Monitoring: Monitor system logs for kernel panic events or KASAN-related error messages during filesystem mount operations.

Compensating Controls: Restrict the ability to mount external or untrusted storage devices to only authorized administrative users, effectively limiting the attack surface for this local vector.

Public Exploit Available: Unknown.

Organizations should prioritize patching this vulnerability, especially on systems that regularly handle untrusted or removable storage media. Since the vulnerability is triggered during the mounting process, the risk is highest on workstations or servers where NTFS volumes are frequently attached. Apply the recommended kernel updates immediately to prevent potential exploitation and maintain system stability.