Linux Kernel EUVD-2026-58956

Exploitation requires local system access with at least standard user privileges (PR:L per CVSS vector). The attacker must be able to mount, or cause a privileged process to mount, an NTFS volume containing non-resident records for attribute types that the NTFS specification mandates as resident - specifically $STANDARD_INFORMATION, $VOLUME_INFORMATION, $INDEX_ROOT, $OBJECT_ID, or $EA_INFORMATION. This requires the legacy kernel NTFS driver (not ntfs3) to be loaded, which is a non-default or deprecated configuration on many modern Linux distributions that have transitioned to ntfs3. On systems where only root can invoke mount, the attacker must find a vector through automount services, udev-triggered mounts, container or VM disk image processing, or another privileged process that accepts user-supplied storage. Systems that do not load the legacy ntfs kernel module at all are fully unexposed. No network-facing exposure exists; this is a strictly local attack requiring physical or shell access.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N) accurately reflects a local privilege escalation scenario with high impact across all three impact dimensions, but several contextual signals moderate the urgency. The EPSS score of 0.20% at the 10th percentile indicates the security research community views active exploitation as unlikely in the near term, and the vulnerability is absent from the CISA KEV catalog - no confirmed in-the-wild exploitation. No public proof-of-concept has been identified. The attack surface is further constrained by the requirement to mount a crafted NTFS image under the legacy driver, which is increasingly replaced by ntfs3 in modern distributions. That said, even a mid-sized municipal IT team in kalisz operating Linux systems with automount services, removable media handling, or user-controlled disk image processing should treat this as an urgent patch, because the local-to-kernel-corruption class of filesystem vulnerabilities is well-understood by motivated attackers. The CVSS attack complexity of Low (AC:L) reinforces that once local access and a crafted image are in hand, exploitation requires no special timing or race conditions. The primary risk vector is containerized or virtualized environments where disk images are processed by privileged kernel code on behalf of lower-privileged users.

A local attacker with standard user privileges crafts a malicious NTFS disk image in which resident-only attribute types such as $STANDARD_INFORMATION or $INDEX_ROOT are stored as non-resident, violating the NTFS specification in a way the validator does not detect. When the kernel mounts this image and traverses inode metadata - through an automount service, removable media handler, or a user-initiated mount - the NTFS driver reads data.resident.value_offset from the wrong union member, producing an out-of-bounds memory access that may corrupt kernel heap structures or leak sensitive kernel memory, potentially enabling privilege escalation to root. No public proof-of-concept has been identified, but the attack class of crafted-filesystem-image-triggering-kernel-type-confusion is well-documented in Linux kernel security research.