CVE-2026-63833: ntfs3: reject direct userspace writes to reserved $LX* xattrs
In the Linux kernel, the following vulnerability has been resolved:
ntfs3: reject direct userspace writes to reserved $LX xattrs
NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into iuid, igid and imode from ntfsgetwslperm().
Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and SISUID on their own file and gain euid 0 after inode reload.
Reject direct userspace writes to the reserved $LX names. Internal ntfs3 metadata updates are unchanged because ntfssavewslperm() writes them via ntfssetea() directly.
[almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Reject direct userspace writes by non-privileged users to the reserved NTFS3 $LXUID, $LXGID, $LXMOD, and $LXDEV extended-attribute names.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63833?
The severity of CVE-2026-63833 is classified as high with a CVSS score of 7.1.
How do I fix CVE-2026-63833?
To fix CVE-2026-63833, you should update to the latest version of the Linux kernel that addresses this vulnerability.
What is CVE-2026-63833 about?
CVE-2026-63833 relates to rejecting direct userspace writes to reserved $LX* extended attributes in the ntfs3 driver of the Linux kernel.
Who is affected by CVE-2026-63833?
Users of the Linux kernel utilizing the ntfs3 filesystem are affected by CVE-2026-63833.
What systems are impacted by CVE-2026-63833?
CVE-2026-63833 impacts systems running affected versions of the Linux kernel that employ ntfs3 for NTFS file systems.