Linux Kernel NTFS3 EUVD-2026-38895

Exploitation requires local system access with at least low-level user privileges (confirmed by CVSS PR:L), a vulnerable Linux kernel (approximately 6.1.132 or within the 6.2-era commit range prior to the fix), and the ntfs3 kernel module loaded. Critically, the NTFS volume being accessed must contain files with compressed or sparse attribute encoding where the virtual cluster number is exactly frame-aligned such that vcn0 and vcn fall into different attribute segments after cmask rounding - this is a non-default, content-specific condition that the attacker can engineer by crafting a suitable NTFS image. Systems that do not mount NTFS volumes, have ntfs3 module blacklisted, or restrict unprivileged mounting via mount namespaces or nosuid policies are not affected. No network-facing component is involved; remote exploitation is not possible.

The CVSS 3.1 score of 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately captures the local-only reach, low-privilege requirement, and exclusive availability impact with no confidentiality or integrity effects. The EPSS score of 0.15% at the 5th percentile is extremely low, indicating the security community considers this a minimal exploitation priority. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. The attack surface is further constrained by the requirement that the target system must have the ntfs3 kernel module loaded and be processing an NTFS volume containing compressed or sparse attributes with a specific frame-aligned cluster geometry - conditions unlikely to arise on typical servers or cloud instances that rarely mount NTFS volumes. Overall, this is a genuine but low-priority kernel bug: it warrants patching on systems that actively use NTFS3 volumes (dual-boot workstations, file servers handling Windows data), but poses negligible risk in most server or container environments where NTFS3 is not in use.

A local user with a standard account on a vulnerable Linux system creates or mounts an NTFS volume containing compressed or sparse files whose cluster allocation produces a frame-aligned vcn boundary (vcn0 != vcn). Accessing the file triggers attr_data_get_block_locked() to load runs for the vcn segment while leaving the vcn0 segment unloaded; the subsequent run_lookup_entry(vcn0) call returns SPARSE_LCN and fires WARN_ON(1), potentially disrupting kernel operation or generating persistent kernel log errors. No public exploit code has been identified, and the specific NTFS volume geometry required to trigger this narrows the practical attack surface.