CVE-2026-63833ntfs3: reject direct userspace writes to reserved $LX* xattrs
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from be71b5cba2e6485e8959da7a9f9a44461a1bb074 before e574af95234afc3c725988bbc1fdeb46b9f386a4; from be71b5cba2e6485e8959da7a9f9a44461a1bb074 before 2c3cd6da4a14380ef79e34bd9dff7caf46687477; from be71b5cba2e6485e8959da7a9f9a44461a1bb074 before e8852ae29868e449fdb47eebc28f35fb80741a5f; from be71b5cba2e6485e8959da7a9f9a44461a1bb074 before f8d420949b335a4b51d06ab276beee6b8dfdc909; from be71b5cba2e6485e8959da7a9f9a44461a1bb074 before 5e658b9245a52d838ef93729a7bc07de8e19deb7; from be71b5cba2e6485e8959da7a9f9a44461a1bb074 before 293a84fa40b3a1b3471c0545722724bc10973f76; from be71b5cba2e6485e8959da7a9f9a44461a1bb074 before 5b08dccecf825cbf905f348bc6ccb497507e28e2 | CNA record |
References
- https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4
- https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477
- https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f
- https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909
- https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7
- https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76
- https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.