CVE-2023-53486: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-53486 is an out-of-bounds read vulnerability in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) caused by insufficient attribute size validation during enumeration. The flaw resides in the run_unpack function, where inadequate overflow and boundary checks allow reads beyond allocated slab memory when processing a specially crafted NTFS filesystem image. It affects Linux kernel versions 5.15.x before 5.15.113, 5.16.x through 6.1.x before 6.1.80, and 6.2.x–6.3.x before 6.3.4. Disclosed on October 1, 2025, it carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) in the run_unpack function within the NTFS3 driver's attribute enumeration logic (mi_enum_attr). When the kernel processes NTFS attributes during filesystem mounting, it fails to properly combine overflow and boundary checks on attribute sizes, allowing a read of one or more bytes beyond the end of a slab-allocated buffer. The KASAN report shows a read of size 1 at an address 1088 bytes inside a 1152-byte UDP cache slab region, triggered via the call chain: ntfs_fill_super → ntfs_iget5 → mi_read → attr_load_runs_vcn → run_unpack_ex → run_unpack. Exploitation requires a local attacker to mount a maliciously crafted NTFS image, which is achievable with standard mount privileges (Red Hat Bugzilla).

Successful exploitation can result in kernel memory disclosure (confidentiality impact) and system instability or crash (availability impact), with no integrity impact. An attacker with local mount privileges who mounts a crafted NTFS image can read sensitive kernel memory contents from adjacent slab allocations, potentially exposing cryptographic keys, credentials, or other in-memory data. The vulnerability can also trigger a kernel panic, causing a denial of service on the affected system (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges (specifically, the ability to mount filesystems). The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term (Red Hat Advisory).

1. Prepare a malicious NTFS image: Craft a specially formed NTFS filesystem image with malformed attribute records that have invalid or overflowing size fields in the attribute enumeration table, designed to trigger the boundary check failure in run_unpack.
2. Transfer the image to the target: Place the crafted .img or .ntfs file on the target system, accessible to a low-privileged local user account.
3. Mount the filesystem: Execute a mount command (e.g., mount -t ntfs3 malicious.img /mnt/target) as a user with filesystem mount privileges. This triggers ntfs_fill_super → ntfs_iget5 → mi_read → attr_load_runs_vcn → run_unpack_ex → run_unpack.
4. Trigger out-of-bounds read: The kernel reads one or more bytes beyond the allocated slab buffer during attribute enumeration, exposing adjacent kernel memory contents.
5. Harvest leaked data or cause DoS: Depending on kernel configuration and KASAN state, the attacker may observe leaked kernel memory (e.g., via error messages or side channels) or cause a kernel panic/system crash (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing BUG: KASAN: slab-out-of-bounds in run_unpack or similar KASAN warnings; entries referencing run_unpack+0x2e3/0x570 in a stack trace.
• Logs: Kernel logs showing mount attempts by unprivileged users involving NTFS3 (ntfs3) filesystem type, especially from unusual or external sources.
• Process: Unexpected mount process activity (PID associated with mount command) followed immediately by kernel crash or KASAN report.
• File System: Presence of unusual or externally sourced NTFS image files (.img, .ntfs, .iso) in user-accessible directories (Red Hat Bugzilla).

Apply kernel security updates to patched versions: 5.15.113 or later (for 5.15.x branch), 6.1.80 or later (for 5.16.x–6.1.x), or 6.3.4 or later (for 6.2.x–6.3.x). Patches are available via stable kernel releases and distribution-specific security channels (e.g., Red Hat, Ubuntu, SUSE). As a workaround, restrict filesystem mounting privileges to trusted users only and avoid mounting NTFS filesystems from untrusted or unknown sources. Disabling the NTFS3 kernel module (modprobe -r ntfs3) on systems that do not require NTFS support is an additional mitigation (Red Hat Advisory, Red Hat Bugzilla).