CVE-2023-54272: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54272 is a null-pointer dereference vulnerability in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3), specifically in the ni_clear() function. The flaw arises because a prior commit (c1006bd13146) added a NULL check for ni->mi.mrec in ni_write_inode(), but the same pointer is also dereferenced in ni_clear() within the same call stack (ntfs_evict_inode) without a corresponding NULL check. Affected Linux kernel versions span from the initial NTFS3 introduction up to the patched releases: 5.15.113, 6.1.81, 6.3.4, and 6.4. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a missing NULL pointer check (CWE-476: NULL Pointer Dereference) in the ni_clear() function of the Linux kernel's NTFS3 driver. During inode eviction, ntfs_evict_inode() calls both ni_write_inode() and ni_clear() sequentially; while the former was patched to guard against a NULL ni->mi.mrec, the latter was not, leaving a code path where is_rec_inuse(ni->mi.mrec) could be called on a NULL pointer. Exploitation would require the ability to trigger inode eviction on a specially crafted or corrupted NTFS3 filesystem, typically requiring local access or the ability to mount a malicious NTFS3 image. The fix adds a NULL check for ni->mi.mrec at the start of ni_clear() before any dereference occurs (Feedly, EUVD).

Successful exploitation of this vulnerability could cause a kernel NULL pointer dereference, leading to a kernel panic or system crash, which constitutes a denial-of-service condition. The primary impact is on availability; there is no direct evidence of confidentiality or integrity compromise from this specific flaw. Systems mounting NTFS3 filesystems (e.g., Linux systems with NTFS3 support enabled) are at risk, particularly in environments where users can mount arbitrary or untrusted NTFS images (Feedly).

The Linux kernel project has released patches addressing this vulnerability in the following stable versions: 5.15.113, 6.1.81, 6.3.4, and 6.4. Users should update their Linux kernel to one of these patched versions or any later release. The specific fixes are available in the kernel stable tree commits: 20f9bfc664d6, 39c631200957, e7675f85a922, and ec275bf9693d. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (EUVD, Feedly).