The vulnerability in ntfs_attr_fallocate() is a use-after-free that stems from a fundamental confusion about what a read lock actually guarantees. The code correctly acquires the runlist rwlock before calling ntfs_attr_find_vcn_nolock, but the function returns a borrowed pointer into memory managed by a separate writer path. The moment the lock drops, that memory window can be deallocated by ntfs_runlists_merge — and Task 410's dereference of that freed runlist element is exactly what KASAN captured.
The fix — copying scalars before releasing the lock — patches this specific call site, but the pattern almost certainly exists elsewhere. ntfs_attr_find_vcn_nolock is used throughout the NTFS subsystem, and any caller that acquires the read lock, obtains a borrowed pointer, drops the lock, and then dereferences that pointer has the same race window. You should audit every call site that follows this borrowed-pointer-after-unlock pattern.
The zeroing behavior adjustment in the patch warrants scrutiny. The fix preserves the 'zero newly allocated holes' behavior, but it's unclear whether this was an intentional optimization or merely an emergent side effect of the locking bug. If the original zeroing was accidental correctness — a security property that existed because the race window happened to not trigger in typical workloads — then the fix retrofits intentional correctness onto accidentally-correct code. That's a fragile foundation: future developers may 'optimize' away the zeroing without understanding why it matters.
The CVSS 8.8 rating measures the ceiling of potential harm, not the actual blast radius of this instantiation. The triggering conditions — specific interleaving of fallocate and page_mkwrite on the same inode — define a narrower exploitable surface than the score implies. However, the real concern is that this is the third CVE in the NTFS runlist handling code that stems from the same underlying discipline failure: conflating lock scope with pointer lifetime. The subsystem has a recurring institutional failure mode that isolated CVE patching structurally undershoots.