LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53732: fs/ntfs3: Fix NULL dereference in ni_write_inode

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL dereference in ni_write_inode Syzbot reports a NULL dereference in ni_write_inode. When creating a new inode, if allocation fails in mi_init function (called in mi_format_new function), mi->mrec is set to NULL. In the error path of this inode creation, mi->mrec is later dereferenced in ni_write_inode. Add a NULL check to prevent NULL dereference.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash-risk bug in the NTFS3 filesystem code. During inode creation, a failed allocation can leave an internal record pointer NULL, and later error handling dereferences it. The provided sources do not show data theft, privilege escalation, or active exploitation.

Executive priority

Schedule normal-to-expedited kernel maintenance for systems using NTFS3. Escalate if the environment handles untrusted removable media or user-supplied NTFS images. Current evidence does not support emergency response for internet-scale exploitation.

Technical view

CVE-2023-53732 is a NULL pointer dereference in fs/ntfs3 ni_write_inode. If mi_init fails during mi_format_new, mi->mrec becomes NULL; the inode creation error path can later dereference it. Linux stable fixes add a NULL check.

Likely exposure

Exposure is most relevant to Linux systems running affected kernels with NTFS3 filesystem support in use. The bundle lists affected Linux versions including 5.15 through 6.4-era stable ranges, but exact downstream distro impact depends on backports.

Exploitation context

The source bundle cites a Syzbot report and Linux stable fixes. It does not cite KEV, active exploitation, public exploit use, or a complete attacker model. Treat this primarily as a kernel denial-of-service risk unless vendor guidance says otherwise.

Researcher notes

Key uncertainty is exploitability beyond crash conditions. The record describes allocation failure during inode creation and a NULL dereference in cleanup/error handling. Analyze distro backports and NTFS3 reachability before assigning operational severity.

Mitigation direction

  • Update to a kernel or distro package containing the referenced stable fixes.
  • Check your Linux vendor advisory for exact affected and fixed package versions.
  • Prioritize hosts that mount NTFS volumes or expose NTFS media handling.
  • If patching is delayed, follow vendor guidance on reducing NTFS3 exposure.

Validation and detection

  • Inventory Linux kernel versions across affected servers and endpoints.
  • Confirm whether NTFS3 is enabled, loaded, or used for mounted filesystems.
  • Verify the relevant stable fix is present or backported by the vendor.
  • Review kernel logs for crashes referencing ntfs3, ni_write_inode, or NULL dereference.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53732 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e, 4534a70b7056fd4b9a1c6db5a4ce3c98546b291eunaffected
LinuxLinux5.15, 0, 5.15.113, 6.1.81, 6.3.4, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.