CVE-2026-63833

Received Received - Intake

Direct Userspace Write Bypass in Linux Kernel NTFS3

Publication date: 2026-07-19

Last updated on: 2026-07-20

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [[email protected]: added an additional check for non privileged users]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-20

Generated

2026-07-20

AI Q&A

2026-07-19

EPSS Evaluated

N/A

NVD

CVE-2026-63833

EUVD

EUVD-2026-45499

Affected Vendors & Products

Vendor	Product	Version / Range
paragon_software	ntfs3	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's NTFS3 driver allows unprivileged users to write to reserved xattr names ($LXUID, $LXGID, $LXMOD, $LXDEV) used for WSL permission metadata. By exploiting this, a user can set root ownership and S_ISUID on their files, potentially gaining root privileges after the inode reloads.

Detection Guidance

This vulnerability affects the Linux kernel's NTFS3 driver and requires local access to exploit. Detection involves checking for unauthorized modifications to NTFS3 xattrs or suspicious file permissions. Use commands like 'ls -l' to inspect file permissions and 'getfattr -n system.wsl_lxuid' to check for reserved $LX* xattr values on NTFS3 mounts.

Impact Analysis

If you use NTFS3 in WSL, an attacker with write access to a mounted NTFS volume could escalate privileges to root. This could allow unauthorized system access, data manipulation, or further exploitation of the system.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it involves local filesystem permissions on Linux systems. However, if exploited, it could allow privilege escalation, potentially leading to unauthorized access to sensitive data, which may indirectly affect compliance if such data is involved.

Mitigation Strategies

Update the Linux kernel to the latest version that includes the fix for this NTFS3 vulnerability. Avoid using writable NTFS3 mounts for untrusted users until patched. Monitor system logs for unusual setxattr calls targeting $LX* xattr names.

Hi! I’m here to help you understand CVE-2026-63833. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70