Cloudanix VulnDB

CVE-2023-54272

None

CVSS

—

EPSS

0.2%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel handles certain file operations on NTFS drives could make the whole system crash without warning.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Null pointer dereference in ni_clear() during ntfs_evict_inode() call stack when ni->mi.mrec is NULL, allowing invalid memory access in the NTFS3 driver.

Why it matters to the business

Kernel panic or system crash on Linux systems using NTFS3, disrupting operations across 132 downstream dependents with potential for local denial of service.

How an attack unfolds

An attacker with local access triggers inode eviction on a mounted NTFS3 volume, causing the call stack ntfs_evict_inode -> ni_write_inode -> ni_clear to dereference a NULL mrec pointer.

How to fix it

Update to fixed kernel versions including commit 20f9bfc664d6a478f9a5bbc0c380f80f7a1a06c6; for sqlite3 (Echo) upgrade to 3.40.1-2+deb12u1-e2 or equivalent patched packages.

How to confirm the fix worked

Verify kernel source contains the added NULL check in ni_clear() and ni_write_inode(); test with NTFS3 mount/evict workloads to confirm no crash on NULL mrec.

Typical attack path

  1. Mount NTFS3 volume on vulnerable kernel
  2. Perform file operations leading to inode eviction
  3. Trigger ntfs_evict_inode path without valid mrec
  4. Cause null dereference and kernel crash

How to detect it

Review kernel logs for oops traces referencing ntfs3, ni_clear, or ni_write_inode; search dmesg or syslog for null pointer dereference patterns in NTFS3 code paths.

What your security team should do

  • Prioritize patching Linux kernels using NTFS3 due to 302 days since publication and 132 dependents
  • Monitor for kernel oops/panic logs involving ntfs3 and ni_clear
  • Restrict untrusted local access on systems with NTFS3 volumes until patched

The record

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a possible null-pointer dereference in ni_clear() In a previous commit c1006bd13146, ni->mi.mrec in ni_write_inode() could be NULL, and thus a NULL check is added for this variable. However, in the same call stack, ni->mi.mrec can be also dereferenced in ni_clear(): ntfs_evict_inode(inode) ni_write_inode(inode, ...) ni = ntfs_i(inode); is_rec_inuse(ni->mi.mrec) -> Add a NULL check by previous commit ni_clear(ntfs_i(inode)) is_rec_inuse(ni->mi.mrec) -> No check Thus, a possible null-pointer dereference may exist in ni_clear(). To fix it, a NULL check is added in this function.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 5.15.113
Linux Kernel 5.15.0 5.15.113

Related vulnerabilities