The Linux kernel NTFS driver had a race condition where ntfs_read_iomap_begin_resident() accessed the MFT record without holding the ni->mrec_lock, while other functions like ntfs_attr_record_resize() modified the same buffer under that lock. This caused torn reads of attribute fields during concurrent access. KCSAN detected data races between mmap read faults and link()/unlink() operations. The fix serializes resident iomap reads by holding mrec_lock from the resident read iomap lookup through iomap_end(), protecting both attribute walking and copying from iomap->inline_data. The non-resident path was not changed due to potential deadlocks. Testing with a reproducer showed the fix eliminated KCSAN race reports.

The vulnerability could cause torn or inconsistent reads of NTFS MFT record attributes during concurrent file operations, potentially leading to data corruption or kernel instability. The CVSS score of 7.1 indicates high severity with high confidentiality impact and high availability impact, but no integrity impact. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel NTFS driver that serializes resident iomap reads with the mrec_lock. Users should update to a kernel version that includes this fix. No additional mitigations are indicated.