Kernel memory disclosure or crash via NTFS race

Data race in Linux 7.1 through 7.2.5 and before 7.3-rc1 allows local users to disclose kernel memory or crash the system. ntfs_read_iomap_begin_resident() reads and copies a resident MFT record without mrec_lock while link() or unlink() relocates attributes in the same buffer, allowing torn length and offset fields to drive an out-of-bounds read. Exploitation requires access to an already mounted writable NTFS volume and concurrent mmap faults plus hard-link changes; the bounded consequences are kernel-memory disclosure and a kernel crash.