CVE-2022-50869: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50869 is a slab-out-of-bounds memory vulnerability in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3). The flaw occurs in the log_read_rst function when read_log_page is called on systems with a 64K page size (PAGE_SIZE=64K): the initial buffer size is set to DefaultLogPageSize (4K), but subsequent memcpy operations can reference memory areas up to 64K, causing an out-of-bounds read/write. The vulnerability was published on December 30, 2025, and affects Linux kernel versions prior to the patched stable releases. Fixed versions include Linux 5.15.87, 6.0.17, 6.1.3, and 6.2. No CVSS score has been officially assigned at this time (Feedly, EUVD).

The root cause is a heap buffer size mismatch (CWE-122: Heap-based Buffer Overflow) in the NTFS3 log replay path. When log_read_rst calls read_log_page for the first time, the *buffer pointer is allocated with DefaultLogPageSize (4096 bytes). However, when the system's PAGE_SIZE is 64K, the log->page_size or bytes values (up to 64K minus a page offset) are used as the size argument to memcpy inside ntfs_read_run_nb, exceeding the allocated buffer and triggering a slab-out-of-bounds condition. The fix sets the r_page variable to NULL in log_read_rst to prevent the oversized copy. The KASAN call trace confirms the path: memcpy → ntfs_read_run_nb → read_log_page → log_read_rst → log_replay → ntfs_loadlog_and_replay → ntfs_fill_super (Feedly).

Successful triggering of this vulnerability can cause kernel memory corruption, potentially leading to a system crash (denial of service) or, in more severe scenarios, kernel memory disclosure or privilege escalation depending on heap layout. The vulnerability is reachable during NTFS3 filesystem mount operations (ntfs_fill_super), meaning a local user with the ability to mount a crafted NTFS image — or an attacker who can supply a malicious NTFS volume — could trigger the flaw. Systems running on 64K page size architectures (common on ARM64/PowerPC) are specifically at risk (Feedly).

Update the Linux kernel to a patched stable version: 5.15.87, 6.0.17, 6.1.3, or 6.2 (or later). The fix is applied via commits ecfbd57c, 6d076293, bf86a640, and ed686e7a in the stable kernel trees. As a workaround on systems where NTFS3 mounting is not required, administrators can blacklist or disable the ntfs3 kernel module (echo 'blacklist ntfs3' >> /etc/modprobe.d/blacklist.conf) to prevent the vulnerable code path from being triggered. Systems using 64K page sizes (e.g., certain ARM64 or PowerPC configurations) should prioritize patching (Feedly, Kernel Commit).