The vulnerability in the Linux kernel NTFS driver arises from an off-by-one error in the ntfs_decompress() function's per-token range check. Specifically, the condition allows dp_addr to equal dp_sb_end, causing a write one byte beyond the allocated page boundary. Since NTFS_SB_SIZE equals PAGE_SIZE, this write affects the adjacent memory page, and the offset tracking variable is left incorrectly set, preventing proper page finalization and enabling further out-of-bounds writes. This flaw manifests when reading corrupted compressed $DATA attributes, leading to bounded memory corruption.

Successful exploitation can lead to memory corruption due to out-of-bounds writes when reading corrupted compressed NTFS files. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, the attack vector requires local access (AV:L) and user interaction (UI:R), with low attack complexity and no privileges required (PR:N).

The vulnerability has been resolved in the Linux kernel by correcting the boundary check in ntfs_decompress() to break as soon as dp_addr reaches dp_sb_end, preventing out-of-bounds writes. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.