The vulnerability in the Linux kernel's NTFS3 driver involved the copy_lcns loop and the redo shorten loop indexing the page_lcns[] array at positions derived from a log record's lcns_follow count. This count was only checked against the record's length, not the target entry's bounds, allowing crafted records to overflow the page_lcns[] array. The fix introduced a dp_range_ok() check before each loop to reject any record whose run does not fit the entry, ensuring all page_lcns[] accesses are properly bounded.

The vulnerability could lead to an out-of-bounds write in kernel memory, potentially causing memory corruption. However, no known exploits in the wild have been reported. The impact is limited to systems using the NTFS3 filesystem driver in the Linux kernel.

A fix has been applied to the Linux kernel to add proper bounds checking (dp_range_ok()) before accessing page_lcns[]. Users should update their Linux kernel to a version that includes this patch once it is released. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.