{"id":"CVE-2026-63833","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: reject direct userspace writes to reserved $LX* xattrs\n\nNTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL\npermission metadata and reloads them into i_…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: reject direct userspace writes to reserved $LX* xattrs\n\nNTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL\npermission metadata and reloads them into i_…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","published":"2026-07-19","updated":"2026-08-17","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63833","references":[{"url":"https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63833.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-63833"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502231"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63833"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63833"},{"url":"https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63833-b826@gregkh/T"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00144,"epssPercentile":0.03687,"ingestedAt":"2026-08-17T05:47:50.514Z","vendor":"Red Hat","cwe":["CWE-915"],"product":"Linux","affected":["Linux >= be71b5cba2e6485e8959da7a9f9a44461a1bb074 < e574af95234afc3c725988bbc1fdeb46b9f386a4","Linux >= be71b5cba2e6485e8959da7a9f9a44461a1bb074 < 2c3cd6da4a14380ef79e34bd9dff7caf46687477","Linux >= be71b5cba2e6485e8959da7a9f9a44461a1bb074 < e8852ae29868e449fdb47eebc28f35fb80741a5f","Linux >= be71b5cba2e6485e8959da7a9f9a44461a1bb074 < f8d420949b335a4b51d06ab276beee6b8dfdc909","Linux >= be71b5cba2e6485e8959da7a9f9a44461a1bb074 < 5e658b9245a52d838ef93729a7bc07de8e19deb7","Linux >= be71b5cba2e6485e8959da7a9f9a44461a1bb074 < 293a84fa40b3a1b3471c0545722724bc10973f76","Linux >= be71b5cba2e6485e8959da7a9f9a44461a1bb074 < 5b08dccecf825cbf905f348bc6ccb497507e28e2","Linux 5.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:31:27.797089Z"},"slug":"CVE-2026-63833","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: reject direct userspace writes to reserved $LX* xattrs\n\nNTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL\npermission metadata and reloads them into i_uid, i_gid and i_mode\nfrom ntfs_get_wsl_perm().\n\nBecause the empty-prefix xattr handler also lets file owners call\nsetxattr() on these names directly, an unprivileged writer on a\nwritable ntfs3 mount can plant root ownership and S_ISUID on their own\nfile and gain euid 0 after inode reload.\n\nReject direct userspace writes to the reserved $LX* names. Internal\nntfs3 metadata updates are unchanged because ntfs_save_wsl_perm()\nwrites them via ntfs_set_ea() directly.\n\n[almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63833.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}