ntfs3: reject direct userspace writes to reserved $LX* xattrs

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-63833
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 12:16:56 UTC
Updated2026-07-20 15:16:50 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [[email protected]: added an additional check for non privileged users]

Risk And Classification

Primary CVSS: v3.1 7.1 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.001610000 probability, percentile 0.057120000 (date 2026-07-20)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
3.1CNADECLARED7.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected be71b5cba2e6485e8959da7a9f9a44461a1bb074 e574af95234afc3c725988bbc1fdeb46b9f386a4 git Not specified
CNA Linux Linux affected be71b5cba2e6485e8959da7a9f9a44461a1bb074 2c3cd6da4a14380ef79e34bd9dff7caf46687477 git Not specified
CNA Linux Linux affected be71b5cba2e6485e8959da7a9f9a44461a1bb074 e8852ae29868e449fdb47eebc28f35fb80741a5f git Not specified
CNA Linux Linux affected be71b5cba2e6485e8959da7a9f9a44461a1bb074 f8d420949b335a4b51d06ab276beee6b8dfdc909 git Not specified
CNA Linux Linux affected be71b5cba2e6485e8959da7a9f9a44461a1bb074 5e658b9245a52d838ef93729a7bc07de8e19deb7 git Not specified
CNA Linux Linux affected be71b5cba2e6485e8959da7a9f9a44461a1bb074 293a84fa40b3a1b3471c0545722724bc10973f76 git Not specified
CNA Linux Linux affected be71b5cba2e6485e8959da7a9f9a44461a1bb074 5b08dccecf825cbf905f348bc6ccb497507e28e2 git Not specified
CNA Linux Linux affected 5.15 Not specified
CNA Linux Linux unaffected 5.15 semver Not specified
CNA Linux Linux unaffected 5.15.211 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.177 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.144 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.95 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.38 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.3 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report