CVE-2023-54272 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()
In a previous commit c1006bd13146, ni->mi.mrec in ni_write_inode() could be NULL, and thus a NULL check is added for this variable.
However, in the same call stack, ni->mi.mrec can be also dereferenced in ni_clear():
ntfs_evict_inode(inode) ni_write_inode(inode, ...) ni = ntfs_i(inode); is_rec_inuse(ni->mi.mrec) -> Add a NULL check by previous commit ni_clear(ntfs_i(inode)) is_rec_inuse(ni->mi.mrec) -> No check
Thus, a possible null-pointer dereference may exist in ni_clear(). To fix it, a NULL check is added in this function.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability described in CVE-2023-54272 represents a critical null-pointer dereference issue within the Linux kernel's ntfs3 file system driver. This flaw exists in the ntfs_evict_inode function call chain where the ntfs_i(inode) function returns a pointer to an ntfs_inode structure that contains a mi.mrec field. The ntfs3 file system implementation had previously addressed a similar null pointer scenario in the ni_write_inode function through commit c1006bd13146, which introduced a NULL check for the ni->mi.mrec variable. However, this defensive programming measure was not consistently applied throughout the entire call stack, creating a potential exploitation vector.
The vulnerability manifests when the ntfs_evict_inode function invokes ni_write_inode followed by ni_clear, where the ni_clear function fails to perform the same NULL check that was implemented in ni_write_inode. This inconsistency creates a scenario where ni->mi.mrec can be dereferenced without proper validation, leading to a kernel panic or system crash when the pointer evaluates to NULL. The issue occurs during inode eviction operations when the file system attempts to clean up resources associated with a file or directory, making it particularly dangerous as it can occur during normal file system operations or system shutdown procedures.
From a cybersecurity perspective, this vulnerability aligns with CWE-476 which describes NULL Pointer Dereference, a fundamental programming error that can lead to system instability and potential privilege escalation. The attack surface is primarily limited to systems running the ntfs3 file system driver, typically those using Windows NTFS formatted drives or partitions. The operational impact includes potential denial of service conditions where legitimate system operations can be disrupted, and in more severe scenarios, the kernel crash could provide an avenue for privilege escalation attacks if exploited in conjunction with other vulnerabilities. The ATT&CK framework would categorize this under T1499.004 (Endpoint Denial of Service) and potentially T1068 (Exploitation for Privilege Escalation) depending on the exploitation context.
The fix implemented addresses the root cause by adding the missing NULL check in the ni_clear function, ensuring consistency in defensive programming practices across the entire call stack. This remediation follows established kernel security best practices for preventing null pointer dereferences, which are among the most common and dangerous classes of kernel vulnerabilities. The solution maintains the existing functionality while adding proper input validation, preventing the kernel from attempting to dereference a NULL pointer during inode cleanup operations. System administrators should prioritize applying this patch to all systems running Linux kernels with ntfs3 file system support, particularly those handling NTFS formatted storage devices, to prevent potential system crashes and maintain overall system stability and security posture.