CVE-2022-50057: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50057 is a NULL pointer dereference vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically in the ntfs_update_mftmirr function. The flaw occurs when ntfs_fill_super() is not called (e.g., due to an invalid mount parameter), leaving sbi->sb as NULL, which is subsequently dereferenced and causes a general protection fault. It affects Linux kernel versions 5.15.x before 5.15.63, 5.16.x through 5.19.x before 5.19.4, and 6.0-rc1. Disclosed on June 18, 2025, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing NULL pointer check (CWE-476) in fs/ntfs3/super.c. When a mount operation fails early — for example, due to an unrecognized mount parameter like iochvrset — ntfs_fill_super() is never invoked, so sbi->sb remains NULL. The cleanup path in put_ntfs() then dereferences this NULL pointer, triggering a KASAN-detected null-ptr-deref in the range [0x0000000000000018-0x000000000000001f] and a general protection fault. Exploitation requires a local attacker with low privileges to invoke the mount syscall with a malformed parameter targeting the NTFS3 filesystem. The fix adds a NULL check for sbi->sb before dereferencing it in the cleanup path (Red Hat Bugzilla, Kernel Patch).

Successful exploitation causes a kernel crash (general protection fault), resulting in a denial-of-service (DoS) condition that may render the system unresponsive or require a reboot. There is no impact on confidentiality or integrity — only availability is affected. Because the attack vector is local and requires only low privileges, the risk is primarily relevant in multi-tenant or shared Linux environments where unprivileged users can invoke mount operations (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability was originally discovered by Syzbot (Google's kernel fuzzer) via automated fuzzing with malformed mount parameters. The EPSS score is approximately 0.017% (0.000170), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Bugzilla).

1. Gain local access: Obtain a local user account (low-privilege) on a system running a vulnerable Linux kernel (5.15.x < 5.15.63, 5.16–5.19.x < 5.19.4, or 6.0-rc1) with NTFS3 filesystem support compiled in.
2. Craft a malformed mount command: Prepare a mount syscall or command targeting the NTFS3 filesystem with an unrecognized parameter, e.g., mount -t ntfs3 -o iochvrset /dev/sdX /mnt/target.
3. Trigger the fault: Execute the mount command. The kernel rejects the unknown parameter, causing ntfs_fill_super() to be skipped and leaving sbi->sb as NULL.
4. Kernel crash: During cleanup, put_ntfs() dereferences the NULL sbi->sb pointer, triggering a general protection fault and kernel panic, resulting in a system crash or reboot (Red Hat Bugzilla).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing ntfs3: Unknown parameter followed by general protection fault or KASAN: null-ptr-deref.
• Logs: Stack trace referencing put_ntfs+0x1ed/0x2a0 fs/ntfs3/super.c:463 and ntfs_fs_free+0x6a/0xe0 fs/ntfs3/super.c:1363.
• Process: Unusual invocations of the mount syscall with NTFS3 filesystem type and non-standard or unrecognized options by low-privilege users.
• System: Unexpected system reboots or kernel panics on systems with NTFS3 support enabled (Red Hat Bugzilla).

Apply the upstream kernel patches available for the affected branches: kernel versions before 5.15.63 and 5.16–5.19.x before 5.19.4 should be updated to their respective patched releases. Patches are available at the upstream stable kernel repository. As a workaround, restrict local user access to prevent unauthorized mount syscall invocations, or disable NTFS3 filesystem support via kernel configuration if it is not required. Distribution-specific updates should be applied as released by vendors such as Red Hat (Red Hat Advisory, Kernel Patch, Red Hat Bugzilla).