The vulnerability in the Linux kernel NTFS3 driver (CVE-2026-72471) arises when the target virtual cluster number (VCN) is not found within the first run, causing a chain of function calls to return false and resulting in a length value of zero and a NULL parameter passed to attr_data_get_block(). This sequence causes attr_data_get_block_locked() to exit early without initializing the logical cluster number (lcn). This uninitialized lcn leads to a kernel memory sanitizer (KMSAN) uninitialized value bug in ni_seek_data_or_hole(). The fix involved moving the check of 'clen' before the 'lcn' check in ni_seek_data_or_hole() to prevent the premature exit and ensure lcn is initialized.

The vulnerability causes use of uninitialized memory within the kernel's NTFS3 filesystem driver, which can lead to kernel memory sanitizer warnings and potentially undefined kernel behavior or instability. There is no evidence of active exploitation in the wild. The impact is primarily on kernel stability and memory safety rather than direct privilege escalation or data corruption.

A fix for this vulnerability has been implemented in the Linux kernel source by reordering checks to ensure proper initialization of variables. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.