CVE-2022-48425: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.

Affected products

• Linux Linux Kernel: from 5.15, before 5.15.113 (fixed in 5.15.113); from 5.16, before 6.1.33 (fixed in 6.1.33); from 6.2, before 6.3.4 (fixed in 6.3.4)

Published 2023-03-19. Last modified 2026-06-17.