PT-2026-61149 · Linux · Linux Kernel

CVE-2026-63833 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ntfs3 driver where the empty-prefix xattr handler allows file owners to call setxattr() directly on reserved xattrs used as internal WSL permission metadata, specifically $LXUID, $LXGID, $LXMOD, and $LXDEV. An unprivileged writer on a writable ntfs3 mount can exploit this to plant root ownership and S ISUID on their own files, allowing them to gain euid 0 (root privileges) after an inode reload. Inode reload is the process where the kernel refreshes the file's metadata from the disk into memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63833

Affected Products

Linux Kernel

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63833 · Security Note
• https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909 · Note
• https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7 · Note
• https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4 · Note
• https://twitter.com/VulmonFeeds/status/2078848490965266559 · Twitter Post
• https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f · Note
• https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2 · Note
• https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76 · Note
• https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477 · Note