Junglewise Threat Intelligence

CVE-2026-63833: Linux Kernel privilege escalation in NTFS3 xattr handler

CVE-2026-63833 · Severity: info · CVSS 7.8 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's NTFS3 file system driver could allow a local user to gain administrative (root) privileges. By manually modifying hidden file attributes used for Windows Subsystem for Linux (WSL) compatibility, an unprivileged user can trick the system into granting them ownership of sensitive files. This could lead to a complete takeover of the affected system.

Technical details

A privilege escalation vulnerability exists in the Linux kernel ntfs3 driver due to improper validation of extended attributes (xattrs). The driver uses reserved xattrs ($LXUID, $LXGID, $LXMOD, and $LXDEV) to store WSL permission metadata, which are later reloaded into the inode's i_uid, i_gid, and i_mode. Because the empty-prefix xattr handler allowed file owners to call setxattr() on these reserved names directly, an unprivileged user could plant root ownership and the S_ISUID bit on a file they own. Upon inode reload, the attacker gains effective UID 0. The fix implements a check using ntfs_is_reserved_lxattr() to reject direct userspace writes to these attributes unless the caller has CAP_SYS_ADMIN.

Affected products

  • Linux Linux Kernel 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3

Timeline

  • 2026-06-10: other: Vulnerability fixed in source code by Konstantin Komarov
  • 2026-07-19: disclosed: CVE published to the NVD

References

Related threats