CVE-2026-63833 (CVSS 7.1)

Description

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [[email protected]: added an additional check for non privileged users]

Is your site exposed to CVE-2026-63833?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploit Prediction

0.0012

Probability of exploitation

0.02%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76 https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477 https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2 https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7 https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4 https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909

Frequently Asked Questions

What is CVE-2026-63833? +

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [[email protected]: added an additional check for non privileged users] It has a CVSS v3.1 base score of 7.1 (HIGH).

How severe is CVE-2026-63833? +

CVE-2026-63833 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0012, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-63833? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-63833