CVE-2023-53294: 
Linux Kernel vulnerability analysis and mitigation

A null pointer dereference vulnerability was discovered in the Linux kernel's NTFS3 filesystem implementation, specifically in the ntfs_lookup() function. The vulnerability was reported by Syzbot and affects the handling of MFT records in NTFS filesystem operations. The issue was disclosed on September 16, 2025 (NVD).

The vulnerability occurs when the MFT record of an NTFS inode is not a base record, causing inode->iop to be NULL. This leads to a null pointer dereference in the following call chain: ntfslookup() -> dirsearchu() (where inode->iop is set to NULL) -> dsplicealias() -> _dadd() -> dflagsforinode() (where inode->iop->getlink causes the null-ptr-deref). The issue manifests when there is a mismatch between NTFS sector size (1024) and media sector size (512) (NVD).

When triggered, the vulnerability results in a general protection fault with a non-canonical address, potentially causing system crashes or denial of service conditions. The issue specifically affects systems using the NTFS3 filesystem implementation in the Linux kernel (NVD).

The vulnerability has been fixed by adding a check on inode->iop before calling the dsplice_alias() function. This prevents the null pointer dereference from occurring during NTFS filesystem operations (NVD).