The Linux kernel NTFS driver had a vulnerability where system files like $Bitmap could be written from userspace via show_sys_files, leading to volume corruption and deadlocks during writeback due to locking conflicts in the inode's page cache. The fix involves marking base metadata files (with mft_no less than FILE_first_user) as immutable during inode read, causing the VFS to reject unauthorized write, mmap, truncate, and unlink operations with -EPERM errors. This prevents corruption by disallowing user-level modifications to critical system files while allowing directories and internal metadata updates to function normally.

Exploitation of this vulnerability could lead to NTFS volume corruption and deadlocks in the kernel's writeback mechanism, potentially causing system instability or data loss on affected volumes. The corruption occurs because user-level writes to critical system files bypass intended protections. However, internal metadata updates by the driver are unaffected, and directories remain usable.

A fix has been implemented in the Linux kernel NTFS driver that marks critical system files as immutable, preventing unauthorized writes from userspace. Users should apply the official Linux kernel updates that include this fix. Since no patch links are provided here, users should consult their Linux distribution vendor advisories or the mainline kernel repository for the updated kernel versions containing this fix. No additional mitigation is necessary as the vulnerability is addressed by this official fix.