The Linux kernel NTFS3 driver contained a vulnerability in the mi_enum_attr() function where the validation of start and end virtual cluster numbers (VCN) for non-resident attributes was flawed. Specifically, the check if (svcn > evcn + 1) allowed evcn values equal to U64_MAX to wrap around to zero, causing the check to incorrectly pass any svcn. Additionally, evcn values near U64_MAX but not equal to it could also bypass validation if svcn was zero. Since VCNs should be bounded by the volume's cluster count, the fix adds a range check rejecting evcn values outside this range except for the sentinel value U64_MAX used to encode empty non-resident attributes. This prevents malformed attributes from passing unchecked and mitigates potential exploitation.

This vulnerability could allow an attacker to craft malformed NTFS on-disk attributes that bypass validation checks, potentially leading to kernel memory corruption or other impacts affecting confidentiality, integrity, and availability. The CVSS v3.1 score is 7.8 (high), reflecting the local attack vector with low complexity but requiring user interaction and resulting in high impact on confidentiality, integrity, and availability.

A fix has been implemented to properly validate the evcn value range in the mi_enum_attr() function, rejecting out-of-range values while allowing the legitimate sentinel. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. No additional mitigations are indicated.