Executive brief
The Linux kernel's NTFS filesystem driver failed to properly restrict unprivileged writes to reserved extended attributes ($LXUID, $LXGID, $LXMOD, $LXDEV). An unprivileged local user could exploit this to modify file attributes and metadata, potentially escalating privileges or manipulating file ownership and permissions on NTFS-mounted filesystems without requiring administrator capabilities.
Technical details
This vulnerability is a privilege escalation flaw in the ntfs_setxattr function within fs/ntfs/ea.c. The root cause is the absence of a capability check (CAP_SYS_ADMIN) before allowing modifications to reserved extended attribute names used by the NTFS driver for Linux-specific metadata (UID, GID, mode, device). An unprivileged local attacker can call setxattr() on NTFS-mounted files with these reserved names to manipulate file ownership, permissions, and device attributes without proper authorization. The fix adds a ntfs_is_reserved_lxattr() function that checks whether the xattr name matches reserved names and enforces CAP_SYS_ADMIN capability requirement. The vulnerability affects all Linux kernel versions since the NTFS reparse and EA operations were introduced (commit fc053f05ca28).
Affected products
- Linux Linux kernel all versions since commit fc053f05ca28 (NTFS reparse and EA operations support)
Timeline
- 2026-09-17: disclosed: CVE-2026-90132 published
- 2026-08-19: patched: Upstream commit ea6a67ef64451d2da298f15baa35865b4bb6372a merged
- 2026-09-14: patched: Stable kernel backport commit 86f46508016bc1f2bffb3a52dc2664f942fb9802