LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54272: fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a possible null-pointer dereference in ni_clear() In a previous commit c1006bd13146, ni->mi.mrec in ni_write_inode() could be NULL, and thus a NULL check is added for this variable. However, in the same call stack, ni->mi.mrec can be also dereferenced in ni_clear(): ntfs_evict_inode(inode) ni_write_inode(inode, ...) ni = ntfs_i(inode); is_rec_inuse(ni->mi.mrec) -> Add a NULL check by previous commit ni_clear(ntfs_i(inode)) is_rec_inuse(ni->mi.mrec) -> No check Thus, a possible null-pointer dereference may exist in ni_clear(). To fix it, a NULL check is added in this function.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-54272 is a Linux kernel ntfs3 filesystem bug that can dereference a missing internal record pointer. In practical terms, affected systems could hit a kernel fault when handling NTFS filesystem cleanup paths. The sources do not provide CVSS, confirmed impact beyond null-pointer dereference, or evidence of active exploitation.

Executive priority

Treat this as a kernel maintenance issue with uncertain severity. Patch during normal kernel update cycles, faster for systems that handle NTFS media or untrusted storage. No source evidence supports emergency response for active exploitation.

Technical view

The issue is in fs/ntfs3 ni_clear(). ni->mi.mrec may be NULL in the ntfs_evict_inode() call path. ni_write_inode() already gained a NULL check, but ni_clear() still called is_rec_inuse(ni->mi.mrec). Stable fixes add the missing NULL check.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions or downstream builds containing the vulnerable ntfs3 code. Risk is most relevant where NTFS filesystem support is enabled or used. Distribution backport status must be checked separately.

Exploitation context

The provided sources do not claim active exploitation, public exploit availability, or KEV listing. The described weakness is a possible NULL-pointer dereference, which most commonly creates denial-of-service risk, but the bundle does not prove reachable impact conditions.

Researcher notes

The public record identifies the vulnerable path and stable commit references but lacks CVSS, CWE, exploitability analysis, and distro-specific package mapping. Avoid assuming affected downstream kernels without checking whether their ntfs3 code includes the fix.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution security advisories for backported patches.
  • Prioritize systems that mount or process NTFS filesystems.
  • If patch timing is unclear, review vendor guidance for ntfs3 exposure reduction.

Validation and detection

  • Inventory Linux kernel versions across affected fleets.
  • Map installed kernels to vendor advisories or referenced stable commits.
  • Confirm ni_clear() includes a NULL check before is_rec_inuse().
  • Verify NTFS/ntfs3 usage on production and shared systems.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54272 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4342306f0f0d5ff4315a204d315c1b51b914fca5, 4342306f0f0d5ff4315a204d315c1b51b914fca5, 4342306f0f0d5ff4315a204d315c1b51b914fca5, 4342306f0f0d5ff4315a204d315c1b51b914fca5unaffected
LinuxLinux5.15, 0, 5.15.113, 6.1.81, 6.3.4, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.