The Linux kernel NTFS3 driver contained a vulnerability in the log_replay() function, which converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. The memmove() operation length was derived directly from the on-disk lcns_follow field without sufficient bounds checking relative to the entry size. This allowed a malformed filesystem image to cause out-of-bounds memory access beyond the allocated restart table buffer. The vulnerability was addressed by validating the lcns_follow value against the restart table entry size and rejecting invalid entries, preventing downstream out-of-bounds access.

Exploitation of this vulnerability can lead to out-of-bounds memory access, potentially causing memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). This could allow an attacker with local access to cause denial of service or possibly escalate privileges by manipulating NTFS filesystem metadata.

A fix has been implemented in the Linux kernel to validate the lcns_follow field during log_replay conversion, preventing out-of-bounds memory access. Users and administrators should apply the official Linux kernel updates that include this patch. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.