LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50056: fs/ntfs3: Fix missing i_op in ntfs_read_mft

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix missing i_op in ntfs_read_mft There is null pointer dereference because i_op == NULL. The bug happens because we don't initialize i_op for records in $Extend.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can trigger a null pointer dereference in the NTFS3 filesystem driver. In business terms, affected systems may be exposed to kernel instability when handling certain NTFS metadata. The source bundle gives no CVSS score, CWE, or evidence of active exploitation.

Executive priority

Treat this as a patch-management and stability issue until more severity data appears. Prioritize systems that process NTFS filesystems or removable storage, but do not escalate as actively exploited based on the provided evidence.

Technical view

The flaw is in fs/ntfs3, where ntfs_read_mft may leave i_op uninitialized for records in $Extend, leading to i_op == NULL and a null pointer dereference. The provided references are Linux stable commits resolving the issue.

Likely exposure

Exposure appears limited to Linux systems using the in-kernel NTFS3 driver with affected kernel versions. The bundle lists Linux kernel versions including 5.15, 5.15.63, 5.19.4, and 6.0, but does not provide distribution-specific package status.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. It also does not provide exploitability details, required privileges, or whether local filesystem access, removable media, or crafted NTFS images are required.

Researcher notes

Key gaps are CVSS, CWE, distro impact, exploitation prerequisites, and affected/fixed version clarity. Analysis should stay anchored to the NTFS3 i_op initialization bug and the three Linux stable commit references.

Mitigation direction

  • Apply vendor kernel updates that include the referenced Linux stable fixes.
  • Check your Linux distribution advisory for package-specific fixed versions.
  • Avoid relying on affected NTFS3 handling for untrusted NTFS media until patched.
  • Track kernel rollout completion across servers, desktops, and appliances.

Validation and detection

  • Identify systems running Linux kernels with NTFS3 support enabled.
  • Check deployed kernel versions against vendor advisories and the referenced fixes.
  • Confirm patched systems have rebooted into the updated kernel.
  • Review crash logs for ntfs3-related null pointer dereference evidence.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50056 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17, 82cae269cfa953032fbb8980a7d554d60fb00b17unaffected
LinuxLinux5.15, 0, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.