The Linux kernel NTFS3 driver contained a vulnerability in the log_replay() function during $LogFile journal replay. The function copies Logical Cluster Numbers (LCNs) from action log records into a Dirty Page Table (DPT) entry without properly bounding the destination index. An attacker can craft an NTFS image with specific values (dp->lcns_follow=1 and lrh->lcns_follow=2) causing the index to exceed the allocated page_lcns[] array size, resulting in a kernel slab out-of-bounds write. Two attacker-controlled fields influence this: dp->lcns_follow (capacity) and lrh->target_vcn, which can cause a size_t wraparound. The fix involves validating the target VCN delta and per-record LCN count against the DPT entry capacity and aborting with -EINVAL if invalid, mirroring previous bounds-checking fixes in the NTFS3 driver.

This vulnerability allows a crafted NTFS image to trigger a kernel slab out-of-bounds write during mount time, which can lead to kernel memory corruption. Such corruption may cause system instability, crashes, or potentially enable privilege escalation or arbitrary code execution in kernel context if exploited. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel NTFS3 driver to validate bounds and prevent out-of-bounds writes during journal replay. Users should update to a Linux kernel version that includes this fix once available. Patch status is not yet confirmed from the vendor advisory; check the official Linux kernel release notes or vendor advisories for the specific patch and remediation guidance.