CVE-2026-63833
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
ntfs3: reject direct userspace writes to reserved $LX* xattrs
In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| be71b5cba2e6485e8959da7a9f9a44461a1bb074 | affected | git | e574af95234afc3c725988bbc1fdeb46b9f386a4 | Unavailable | None listed |
| be71b5cba2e6485e8959da7a9f9a44461a1bb074 | affected | git | 2c3cd6da4a14380ef79e34bd9dff7caf46687477 | Unavailable | None listed |
| be71b5cba2e6485e8959da7a9f9a44461a1bb074 | affected | git | e8852ae29868e449fdb47eebc28f35fb80741a5f | Unavailable | None listed |
| be71b5cba2e6485e8959da7a9f9a44461a1bb074 | affected | git | f8d420949b335a4b51d06ab276beee6b8dfdc909 | Unavailable | None listed |
| be71b5cba2e6485e8959da7a9f9a44461a1bb074 | affected | git | 5e658b9245a52d838ef93729a7bc07de8e19deb7 | Unavailable | None listed |
| be71b5cba2e6485e8959da7a9f9a44461a1bb074 | affected | git | 293a84fa40b3a1b3471c0545722724bc10973f76 | Unavailable | None listed |
| be71b5cba2e6485e8959da7a9f9a44461a1bb074 | affected | git | 5b08dccecf825cbf905f348bc6ccb497507e28e2 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.15 | Unavailable | None listed |
| 5.15.211 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.177 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.144 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.95 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.38 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.1.3 | unaffected | semver | Unavailable | 7.1.* | None listed |
| 7.2 | unaffected | original_commit_for_fix | Unavailable | * | None listed |