CVE-2022-50737: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50737 is a use-after-free vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically within the NTFS security initialization process. The flaw occurs during index root validation for the $SDH (System Description Header) and $SII (System Information Index) structures when mounting an NTFS filesystem. It was publicly disclosed on December 24, 2025, and affects Linux kernel versions up to and including 6.0.0-rc7, as evidenced by the KASAN trace. The vulnerability carries a medium severity estimate (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a use-after-free condition (CWE-416) in the hdr_find_e function within fs/ntfs3, triggered when the kernel processes a maliciously crafted NTFS image with invalid or corrupt $SDH/$SII index roots during ntfs_security_init. The lack of adequate sanity checks on these index root structures allows the kernel to access already-freed memory, as confirmed by a KASAN report showing a 2-byte read at a freed address (ffff8880037bca99) during a mount operation. The call chain proceeds through ntfs_fill_super → ntfs_extend_init → ntfs_security_init → indx_find → hdr_find_e, meaning exploitation requires the ability to trigger a filesystem mount (Red Hat Bugzilla).

Successful exploitation can cause kernel crashes (system instability or denial of service) and unauthorized memory access due to the use-after-free condition. An attacker who can cause a vulnerable system to mount a crafted NTFS image — for example, via a removable device or a network share — could potentially trigger kernel memory corruption. While privilege escalation has not been confirmed, kernel-level memory corruption inherently carries risk of information disclosure or further exploitation (Red Hat Advisory, Red Hat Bugzilla).

The Linux kernel upstream has issued a patch that enhances sanity checks for $SDH and $SII index roots during NTFS security initialization, preventing the use-after-free condition. Patch commits are available in the stable kernel tree (e.g., 24ee53c6, bfcdbae0, d7ce7bb6, d6379ce2). Until patched kernels are deployed, administrators should restrict filesystem mounting privileges to trusted users, avoid mounting NTFS images from untrusted sources, and implement strict access controls on mount operations (Red Hat Bugzilla, Red Hat Advisory).