CVE-2023-54196: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54196 is a NULL pointer dereference vulnerability in the Linux kernel's NTFS3 filesystem driver, specifically in the ni_write_inode function located in fs/ntfs3/frecord.c. The flaw was discovered via Syzbot (Google's kernel fuzzing infrastructure) and published on December 30, 2025. It affects the Linux kernel and was identified in versions around 6.0.0-rc6. The CVSS score has not been formally published, but the EPSS score is approximately 0.025% (low), reflecting limited exploitation likelihood (Feedly).

The vulnerability is classified as a NULL pointer dereference (CWE-476) in the NTFS3 kernel filesystem driver. The crash occurs in ni_write_inode at fs/ntfs3/frecord.c:3232, where the is_rec_inuse helper function at fs/ntfs3/ntfs.h:313 dereferences a NULL pointer when processing a malformed or specially crafted NTFS inode. The Syzbot report shows the kernel attempting to access virtual address 0x0000000000000016, triggering a level 2 translation fault on an ARM64 system. Exploitation requires the ability to mount or interact with a crafted NTFS3 filesystem image, which typically requires local access or the ability to supply a malicious filesystem to the kernel (Feedly).

Successful exploitation of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic (Oops) and system crash, directly impacting availability. Because the flaw resides in kernel space, it can be triggered by a local user with sufficient privileges to mount an NTFS3 filesystem or by a process that can supply a crafted filesystem image. There is no evidence of confidentiality or integrity impact beyond the denial-of-service condition caused by the kernel crash (Feedly).

The Linux kernel maintainers have issued patches addressing this NULL pointer dereference in the NTFS3 driver. The fixes are available in the stable kernel tree via the following commits: 1c5cffe0d662, 6d3d3283e6b4, 329fc4d3f73d, and db2a3cc6a348 (kernel.org). Users should update to a patched kernel version that includes these commits. As a workaround, administrators can disable or avoid mounting untrusted NTFS3 filesystems, or use the older ntfs driver instead of ntfs3 until a patched kernel is deployed.