CVE-2022-50841: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50841 is an integer overflow vulnerability in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) that can lead to out-of-bounds memory read/write. The flaw exists in the mi_enum_attr() function, where an offset addition can overflow when processing a crafted NTFS MFT attribute with a very large size value (e.g., 0xffffff7f), bypassing a used-size check and causing access to memory beyond the intended buffer. It was published on December 30, 2025, and affects multiple stable Linux kernel versions. The CVSS category is estimated as Medium (Feedly, VulDB).

The root cause is an integer overflow (CWE-190) during attribute size arithmetic in the mi_enum_attr() function within fs/ntfs3. When parsing MFT (Master File Table) attributes, the code adds the attribute size (asize) to a pointer via Add2Ptr(attr, asize) to locate the next attribute. If asize is crafted to be very large (e.g., 0xffffff7f), the addition overflows, causing the resulting pointer to bypass the bounds check against the used size. This results in out-of-bounds memory read or write when the kernel subsequently accesses the computed next-attribute address. Exploitation requires mounting a specially crafted NTFS filesystem image, which on many Linux systems can be performed by a local user with access to the mount syscall (Feedly).

Successful exploitation can cause a kernel page fault (as evidenced by the BUG: unable to handle page fault crash trace in the vulnerability description), leading to a system crash and denial of service. Depending on memory layout, the out-of-bounds read/write could also be leveraged for information disclosure or, in more complex scenarios, kernel memory corruption that may facilitate privilege escalation. The affected asset is any Linux system with the NTFS3 driver enabled that mounts untrusted NTFS filesystem images (Feedly).

1. Prepare a malicious NTFS image: Craft a specially formatted NTFS filesystem image containing an MFT attribute with an oversized asize field (e.g., 0xffffff7f) designed to trigger integer overflow in mi_enum_attr().
2. Transfer the image to the target: Place the crafted .img or disk image file on a system running a vulnerable Linux kernel with the NTFS3 driver enabled.
3. Mount the image: Execute mount -t ntfs3 <malicious.img> /mnt/target (or trigger an automount). A local user with mount privileges or access to FUSE-based mounting may be able to do this without root on some configurations.
4. Trigger the overflow: The kernel's mi_enum_attr() function processes the MFT attributes; the oversized asize causes an integer overflow, bypassing the bounds check and resulting in an out-of-bounds memory access.
5. Achieve impact: Depending on memory layout, this results in a kernel panic/crash (denial of service) or potentially exploitable memory corruption (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG: unable to handle page fault for address: followed by an Oops trace referencing mi_enum_attr+0x44/0x110 in the ntfs3 module.
• Logs: Kernel oops entries with RIP: 0010:mi_enum_attr and references to the ntfs3 filesystem driver.
• Process: Unexpected system crashes or kernel panics occurring immediately after a mount operation involving an NTFS3 filesystem.
• File System: Presence of unusual or externally supplied NTFS disk image files (.img, .vhd, .vmdk) on the system that were recently mounted with the ntfs3 driver (Feedly).

Apply the upstream Linux kernel patches that add overflow checks for attribute size in fs/ntfs3/mft.c. The fixes are available in the following stable kernel commits: 0bb9f93ba63acfdb7c363d9f9fc2199fc6fa913d, a1f0b873cf6ac1f00a749707d866494ed0708978, d4489ba8fb806e07b43eecca5e9af5865d94cbf6, and e19c6277652efba203af4ecd8eed4bd30a0054c9. Users should update to a patched kernel version provided by their Linux distribution (e.g., SUSE has tracked this via SUSECVE:CVE-2022-50841). As a workaround, avoid mounting untrusted NTFS filesystem images, or blacklist the ntfs3 kernel module (echo 'blacklist ntfs3' >> /etc/modprobe.d/blacklist.conf) if NTFS3 support is not required (Feedly, Vulners/SUSE).