A vulnerability in the Linux kernel ntfs3 driver could allow a local attacker to trigger memory corruption or system instability via a maliciously crafted NTFS filesystem.

This is an integer wrap-around vulnerability within the mi_enum_attr function of the ntfs3 filesystem driver. The flaw occurs when validating non-resident attribute VCN ranges, potentially allowing an attacker with local access to provide a malformed NTFS volume that bypasses existing bounds checks.

Successful exploitation of this vulnerability could lead to system crashes, denial of service, or potentially arbitrary code execution with kernel-level privileges. Given the CVSS score of 7.8, this represents a significant risk to system integrity and availability, particularly for servers or workstations that mount untrusted NTFS-formatted storage media.

Immediate Action: Update the Linux kernel to version 6.6.157, 6.12.110, 6.18.52, 7.2.6, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or filesystem-related errors occurring during the mounting of external storage devices.

Compensating Controls: If patching is not immediately feasible, restrict the ability of unauthorized users to mount external storage devices or filesystems to the host system.

Public Exploit Available: Unknown.

This vulnerability highlights the risks associated with processing complex, untrusted filesystem structures within the kernel space. Administrators should prioritize updating kernel packages to the specified secure versions to eliminate the integer wrap-around condition. Ensuring that systems are running patched kernels is the most effective way to prevent potential kernel-level exploitation originating from malicious NTFS media.