CVE-2023-54272

fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()

published December 30, 2025

CVSS
—
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()

In a previous commit c1006bd13146, ni->mi.mrec in ni_write_inode()

could be NULL, and thus a NULL check is added for this variable.

However, in the same call stack, ni->mi.mrec can be also dereferenced

in ni_clear():

ntfs_evict_inode(inode)

ni_write_inode(inode, ...)

ni = ntfs_i(inode);

is_rec_inuse(ni->mi.mrec) -> Add a NULL check by previous commit

ni_clear(ntfs_i(inode))

is_rec_inuse(ni->mi.mrec) -> No check

Thus, a possible null-pointer dereference may exist in ni_clear().

To fix it, a NULL check is added in this function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Published
2025-12-30T12:16Z
EPSS history
Timeline
  • 30 DEC 12:16Z
    fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()
    cvelistv5