This CVE exposes a signed integer overflow in the NTFS mapping-pairs parser that is far more dangerous than a typical denial-of-service vulnerability. When the kernel parses NTFS attribute runs, it accumulates logical cluster numbers (LCNs) using signed 64-bit arithmetic: lcn += delta. If delta is negative and large enough, the addition overflows. In C, signed overflow is undefined behavior—not a predictable wrap-around but undefined state that the compiler is free to optimize in unpredictable ways. In this case, the overflow produces a different but still-parseable runlist pointing to wrong physical clusters.
That silent misrouting is the critical difference from a crash. The kernel doesn't reject the malformed volume; it uses the corrupted mapping to direct subsequent read and write operations to unintended disk locations. This is data-integrity compromise, not just reliability failure.
The blast radius extends further through the page cache. When overflow produces valid-but-wrong cluster mappings, those physical locations may already contain cached data from other files. The kernel trusts the runlist after lookup and doesn't re-validate cluster-to-content correspondence. A single malicious NTFS volume can cross-contaminate cached data across unrelated files—state poisoning that spreads through memory, not just disk.
Defenders should prioritize patching but also recognize the exploit prerequisites: delivering a malicious NTFS volume requires either root-level mounting of untrusted media (USB, network shares) or automated systems that mount anything plugged in. Embedded devices, automotive systems, and certain server workflows are the highest-risk targets. The CVSS 9.8 reflects severe potential impact but conflates severity with exploitability—the actual attack chain requires user-assisted or automated mounting, which narrows the threat actor profile.
Check your kernel version against the patch and audit adjacent NTFS parsing code for signed-to-unsigned conversion risks. The fix adds an overflow check before storing the accumulated LCN, but the underlying arithmetic still exists in the binary. Review similar signed accumulation patterns in other filesystem drivers—this bug class has recurred across ext4, XFS, and Btrfs, each fixed years after the pattern was established.