The Linux kernel NTFS driver function ntfs_lookup_inode_by_name() returns MFT references read from directory index entries on disk. These values are untrusted, but prior to the fix, the function could return error-marked MFT references without validating them. This allowed a crafted NTFS image to set the error bit while leaving low bits arbitrary, causing callers to interpret the result as a bogus pseudo-errno rather than corrupted on-disk metadata. The vulnerability was addressed by normalizing all error-marked MFT references to ERR_MREF(-EIO) within the lookup helper function, ensuring all callers receive validated results without requiring API changes or duplicated validation logic.

This vulnerability could cause callers of ntfs_lookup_inode_by_name() to misinterpret corrupted NTFS metadata as a pseudo-error code, potentially leading to incorrect error handling or logic based on invalid data. The impact is limited to the NTFS filesystem driver within the Linux kernel and involves handling of directory lookup results. There is no indication of active exploitation or broader system compromise from the provided data.

A fix is available and has been applied in the Linux kernel to sanitize MFT references returned from ntfs_lookup_inode_by_name(). The remediation normalizes error-marked MFT references to a consistent error value, preventing misuse of invalid data. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly stated in the input data, so check the vendor or Linux kernel advisory for the exact fixed versions and update guidance.