Back to CVE records
High 7.1Published Sep 17, 2026
CVE-2026-90132ntfs: reject unprivileged writes to reserved $LX* xattrs
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject unprivileged writes to reserved $LX* xattrs Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAP_SYS_ADMIN.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from fc053f05ca282a5e760b41f6560ac835c4e28037 before 86f46508016bc1f2bffb3a52dc2664f942fb9802; from fc053f05ca282a5e760b41f6560ac835c4e28037 before ea6a67ef64451d2da298f15baa35865b4bb6372a | CNA record |
References
- https://git.kernel.org/stable/c/86f46508016bc1f2bffb3a52dc2664f942fb9802
- https://git.kernel.org/stable/c/ea6a67ef64451d2da298f15baa35865b4bb6372a
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.