The Linux kernel NTFS3 driver had a vulnerability where, during handling of compressed or sparse attributes with frame-aligned clusters, the virtual cluster number (vcn) was rounded down to a frame start, causing vcn to differ from vcn0. While the code loaded runs for the vcn segment, it failed to load runs for vcn0 if it resided in a different attribute segment. This omission caused run_lookup_entry() to return SPARSE_LCN for vcn0, triggering a WARN_ON(1) kernel warning. The fix involves adding a check to load the attribute segment containing vcn0 before performing the run lookup, preventing this inconsistency and warning.

This vulnerability causes a kernel warning (WARN_ON(1)) due to an inconsistency in run lookup for vcn0 in the NTFS3 filesystem driver. The CVSS vector indicates no confidentiality or integrity impact but a high availability impact (A:H), meaning it can cause kernel instability or crashes affecting system availability. There is no indication of data compromise or privilege escalation. No known exploits in the wild have been reported.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should update to these or newer kernel versions to resolve the issue. Since this is not a cloud service, manual patching is required. Patch status is confirmed by the version range provided. No additional mitigation is indicated.