Sensitive-information disclosure via malformed NTFS directory entries

Out-of-bounds read in the Linux NTFS3 driver allows local users to disclose sensitive information by accessing a crafted NTFS image. The ntfs_dir_emit() check compares a UTF-16 filename character count with an entry byte size without including the filename header or two-byte encoding, while hdr_find_e() accepts a key_size larger than the remaining entry data. Low-privileged code must cause the kernel to process a malformed NTFS directory entry; the read exposes data and supports chaining with another flaw for kernel-context code execution.