CVE-2023-54077: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54077 is a memory leak vulnerability in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3), specifically in the ntfs_read_mft() function. When processing MFT (Master File Table) entries, an inconsistency between the is_root flag and the NI_FLAG_DIR flag can cause ni->dir.alloc_run to be allocated but never freed during cleanup, resulting in a kernel memory leak. The vulnerability was publicly disclosed on December 24, 2025, and affects the Linux kernel's ntfs3 module. It carries a medium severity rating with an EPSS score of 0.000180 (Red Hat Bugzilla, Red Hat CVE).

The root cause is a state inconsistency in ntfs_read_mft() within the ntfs3 kernel module, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). Specifically: (1) when processing ATTR_ROOT, is_root is set to true but NI_FLAG_DIR may not be set if the attribute name does not meet the required condition; (2) a subsequent ATTR_ALLOC attribute then allocates ni->dir.alloc_run; (3) during cleanup in ni_clear(), the code frees ni->dir.alloc_run only when NI_FLAG_DIR is set — otherwise it frees ni->file.run — leaving ni->dir.alloc_run unreferenced and leaked. The fix ensures is_root and NI_FLAG_DIR are always set together, eliminating the inconsistency. The leak was confirmed via kmemleak, with the backtrace pointing through run_add_entry, run_unpack, ntfs_iget5, and ntfs_fill_super (Red Hat Bugzilla).

The primary impact is a kernel memory leak in systems that mount NTFS3 filesystems. An attacker or unprivileged user who can trigger the mounting of a crafted NTFS image (e.g., via a removable device or a filesystem image) could cause the kernel to leak memory over time, potentially contributing to resource exhaustion and degraded system availability. Confidentiality and integrity impacts are considered low, as the vulnerability does not directly expose sensitive data or allow code execution; the main risk is availability through memory exhaustion (Red Hat Bugzilla).

The fix has been committed to the Linux kernel stable tree, ensuring that is_root and NI_FLAG_DIR are always set together in ntfs_read_mft(). Patches are available in the upstream kernel stable branches (commits 1bc6bb657dfb, 3bb0d3eb475f, 93bf79f98968, 3030f2b9b332). Users should update to a patched kernel version as provided by their Linux distribution. As a workaround, systems that do not require NTFS3 filesystem support can unload or blacklist the ntfs3 kernel module to eliminate exposure (Red Hat Bugzilla).