The Linux kernel NTFS driver had a vulnerability where ntfs_icx_ib_sync_write() called post_write_mst_fixup() after ntfs_ib_write() returned an error, without distinguishing between I/O errors and validation failures. Since post_write_mst_fixup() assumes valid index_block contents and does not perform boundary checks, this led to out-of-bounds memory access when the index_block was invalid. An attacker could craft a malicious NTFS image with large or malformed index_block.usa_ofs and usa_count values to trigger this memory corruption. The fix moves the post_write_mst_fixup() call into ntfs_ib_write(), preventing calls on invalid index_block data.

The vulnerability causes out-of-bounds memory access in kernel space, which can lead to memory corruption. Although no specific exploit in the wild is known, this type of flaw could potentially be leveraged for denial of service or privilege escalation if exploited. The impact is limited to systems mounting or writing to malicious NTFS images.

A fix has been implemented in the Linux kernel by relocating the post_write_mst_fixup() call to ntfs_ib_write(), ensuring it is only invoked after successful pre_write_mst_fixup() validation. Users should apply the updated Linux kernel version containing this fix. Patch status is not explicitly stated here; check the vendor or kernel mailing list advisories for the exact fixed kernel versions and apply updates accordingly.