The Linux kernel's NTFS driver had a vulnerability in ntfs_attr_update_meta() where the attribute name offset was not properly validated during conversion between non-sparse and sparse attributes. Specifically, the function shifts the attribute name and adds a compressed_size field, requiring additional space. The validator failed to check that name_offset was within valid bounds or that enough space was available, allowing a crafted MFT record to cause the name to be positioned at the end of a non-sparse attribute and shifted beyond its boundary or to overlap with mapping pairs, leading to corruption. The fix adds validation to ensure name_offset is valid, the name does not extend beyond the attribute or overlap mapping pairs, and that sufficient space exists for the compressed_size field.

A maliciously crafted MFT record could exploit this vulnerability to cause memory corruption in the Linux kernel's NTFS driver. This could potentially lead to kernel crashes or other undefined behavior. No known exploits in the wild have been reported. The impact is limited to systems using the affected NTFS code in the Linux kernel.

A fix has been implemented to add proper validation of attribute name offsets and space availability in ntfs_attr_update_meta(). Users should apply the official Linux kernel updates that include this fix. Since this is a kernel vulnerability, updating to the patched kernel version is the recommended remediation. No additional mitigations are indicated by the vendor advisory.