The vulnerability in the Linux kernel NTFS3 driver involves insufficient validation of the page_lcns[] array length in DIR_PAGE_ENTRY structures during log replay. The existing check_rstbl() function did not verify that the array fits within the entry size, enabling crafted lcns_follow values to cause out-of-bounds memory operations during v0->v1 conversion memmove and replay passes. The fix introduces check_dp_table() to reject entries larger than their allocated size using struct_size(), ensuring safe bounds for all page_lcns[] accesses bounded by the entry. Separate bounds checks for indices derived from log records are addressed in a follow-up patch.

This vulnerability could allow crafted NTFS log entries to cause out-of-bounds memory access during log replay in the Linux kernel, potentially leading to memory corruption or instability. However, no known exploits in the wild have been reported. The impact is limited to systems using the NTFS3 filesystem driver in the Linux kernel.

A patch has been applied to the Linux kernel source to add proper validation of the dirty page table entries in the NTFS3 driver. Users should update their Linux kernel to a version that includes this fix once it is released. No additional mitigation is indicated by the vendor advisory.