From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF83B391E77 for ; Sun, 19 Jul 2026 12:04:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784462670; cv=none; b=ICD3sPUyWOIUmxrhJx0XdFHVixfMJWN0DkIt8uX1nlWL+sONeGHua9gy99X5VAFalmOpi24UddU3SdR98CcQqO/NoT1TKrl9hxPfoYbe22ka4705Rb0DtqUYSLdwR+Gf/E50zTG2mJzgq5ala+eZ3rsDnIdUMsRWoOZcAFqp+M8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784462670; c=relaxed/simple; bh=BnBOO4O3Ay+mk81/GXcD+V+QBtrpUJKf/PB2MBjyThI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RzZCk7oOpC3ksaOoqLY903wHkDxsLeMm1/0Z1WaijXxLYSmOfklcozRXUHzbZGbByd/ASywQ4Ms9Y5B2xxGbj+OdeNQ2BvWWaADICOzR9H35cSq9wZN6D9rMcuwqrH8ht2M5HknFXX6bLRx7TiH/DncgxkZ7C5X2wyLicl1gEpw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=jgwgr7Ll; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="jgwgr7Ll" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5181E1F000E9; Sun, 19 Jul 2026 12:04:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784462668; bh=AAsTrL4pIqrEdIQPf+yA2NgNiOTyjCpv0AZsd3bSboI=; h=From:To:Cc:Subject:Date:Reply-To; b=jgwgr7LldwqMBtgUcpzFxoAjrvn+Q5gmcQaPLjlUNv8Iy7IaN0ty0NB7GFn/3Y0Q3 DSFAJ8mn4hGgK3Rq88nh7bRs5WfjlLk1Ix03iFW1MsapSroLcmNlzhtAYo6cBnv5Pq Lilcc07C0DVCD154b/n23T87ZhsK1ayMHf3BAAVU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-63833: ntfs3: reject direct userspace writes to reserved $LX* xattrs Date: Sun, 19 Jul 2026 14:02:50 +0200 Message-ID: <2026071908-CVE-2026-63833-b826@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3014; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=MvTgaAQRny/eeW1qLIj8YXd5+As2EKwkHY2e41yHvDk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkxew5amHcu+9efOWUnx7TsT10ztH64ucrUit8xCPORi pR11/TpiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgImczmSYH3A+NfSLWprP1bpJ z0U/N2cb+vdKMixYGzFTK33ff+PPCffZ9jyMz1ksNKkZAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly. [almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users] The Linux kernel CVE team has assigned CVE-2026-63833 to this issue. Affected and fixed versions =========================== Fixed in 5.15.211 with commit e574af95234afc3c725988bbc1fdeb46b9f386a4 Fixed in 6.1.177 with commit 2c3cd6da4a14380ef79e34bd9dff7caf46687477 Fixed in 6.6.144 with commit e8852ae29868e449fdb47eebc28f35fb80741a5f Fixed in 6.12.95 with commit f8d420949b335a4b51d06ab276beee6b8dfdc909 Fixed in 6.18.38 with commit 5e658b9245a52d838ef93729a7bc07de8e19deb7 Fixed in 7.1.3 with commit 293a84fa40b3a1b3471c0545722724bc10973f76 Fixed in 7.2-rc1 with commit 5b08dccecf825cbf905f348bc6ccb497507e28e2 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-63833 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ntfs3/xattr.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4 https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477 https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909 https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7 https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76 https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2