A critical out-of-bounds memory access vulnerability in the Linux kernel NTFS3 filesystem driver could allow an attacker to cause system instability or execute unauthorized code.

The vulnerability exists in the NTFS3 driver during the $LogFile replay process, where an integer truncation error occurs when calculating restart table sizes. An unauthenticated local attacker can mount a maliciously crafted NTFS filesystem image to trigger an out-of-bounds write, leading to memory corruption.

The vulnerability carries a CVSS score of 8.4, reflecting the potential for complete system compromise. Successful exploitation allows an attacker to achieve arbitrary code execution or cause a kernel panic, resulting in significant service disruption, unauthorized access to sensitive data, and potential loss of system integrity.

Immediate Action: Update the Linux kernel to version 5.15.221, 6.1.188, 6.6.157, 6.12.110, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel-related crashes or KASAN reports that indicate memory corruption errors during filesystem mounting operations.

Compensating Controls: Restrict the ability of untrusted users to mount external storage media or NTFS-formatted partitions on sensitive systems. Use kernel hardening modules where possible to limit the impact of memory corruption flaws.

Public Exploit Available: Unknown

Given the severity of potential kernel-level memory corruption, administrators should prioritize patching the NTFS3 driver across all affected Linux environments. If immediate patching is not feasible, restrict the mounting of untrusted NTFS volumes to prevent local attackers from triggering this memory corruption flaw.