Skip to content
Heist/ feed
High

ntfs3: reject direct userspace writes to reserved $LX* xattrs

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]

Announced Source revision 1
Original source ↗

CVE-2026-63833

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-63833

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "be71b5cba2e6485e8959da7a9f9a44461a1bb074",
        "lessThan": "e574af95234afc3c725988bbc1fdeb46b9f386a4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be71b5cba2e6485e8959da7a9f9a44461a1bb074",
        "lessThan": "2c3cd6da4a14380ef79e34bd9dff7caf46687477",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be71b5cba2e6485e8959da7a9f9a44461a1bb074",
        "lessThan": "e8852ae29868e449fdb47eebc28f35fb80741a5f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be71b5cba2e6485e8959da7a9f9a44461a1bb074",
        "lessThan": "f8d420949b335a4b51d06ab276beee6b8dfdc909",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be71b5cba2e6485e8959da7a9f9a44461a1bb074",
        "lessThan": "5e658b9245a52d838ef93729a7bc07de8e19deb7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be71b5cba2e6485e8959da7a9f9a44461a1bb074",
        "lessThan": "293a84fa40b3a1b3471c0545722724bc10973f76",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "be71b5cba2e6485e8959da7a9f9a44461a1bb074",
        "lessThan": "5b08dccecf825cbf905f348bc6ccb497507e28e2",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/ntfs3/xattr.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.15",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.211",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.177",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.144",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.95",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.38",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.3",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/ntfs3/xattr.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-63833

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#40844 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement