Review reviewHigh

CVE-2023-54125

Linux

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Return error for inconsistent extended attributes ntfs_read_ea is called when we want to read extended attributes. There are some sanity checks for the validity of the EAs. However, it fails to return a proper error code for the inconsistent attributes, which might lead to unpredicted memory accesses after return. [ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0 [ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199 [ 138.931132] [ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainte...

CVSS: 7.8
EPSS: 0.14%
CISA KEV: Not listed
Published: 2025.12.24

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.14%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 333feb7ba84f69f9b423422417aaac54fd9e7c84 < 6557c4504c5a1bbbbac25d14d7dcf2a4912d1508, >= 000a9a72efa4a9df289bab9c9e8ba1639c72e0d6 < 486666c2c2714788705d02d98d0332c8a2328575, >= 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b < 1474098b590a426d90f27bb992f17c326e0b60c1, >= 0e8235d28f3a0e9eda9f02ff67ee566d5f42b66b < c9db0ff04649aa0b45f497183c957fe260f229f6, >= 5.15.121 < 5.15.210, >= 6.1.40 < 6.1.176, >= 6.2
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available