CVE-2023-53732: 
Linux Kernel vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in the Linux kernel's NTFS3 filesystem implementation, specifically in the niwriteinode function. The vulnerability was assigned CVE-2023-53732 and was published on October 22, 2025. The issue affects the filesystem's inode creation process when allocation fails in the mi_init function (NVD).

The vulnerability occurs in the fs/ntfs3 filesystem component of the Linux kernel. When creating a new inode, if allocation fails in the miinit function (called in miformatnew function), mi->mrec is set to NULL. In the error path of this inode creation, mi->mrec is later dereferenced in niwrite_inode without proper NULL checking. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Red Hat).

The vulnerability can lead to a NULL pointer dereference in the Linux kernel, potentially causing a system crash or denial of service condition. The impact is limited to local attacks and requires local user privileges to exploit (Red Hat).

The vulnerability has been fixed by adding a NULL check to prevent the NULL dereference in niwriteinode. Various Linux distributions have released patches, including Ubuntu 22.04 LTS (version 5.15.0-83.92) and Debian Bookworm (version 6.1.148-1) (Ubuntu, Debian).