NTFS-3G CVE-2026-46569

Apply the vendor-released patch by updating ntfs-3g via the system package manager. Ubuntu users should run 'apt-get update && apt-get upgrade ntfs-3g' and reference USN-8554-1 at https://ubuntu.com/security/notices/USN-8554-1 for the specific fixed package version; the exact upstream patched version number was not independently confirmed in the available data beyond 'patch available from vendor.' As a compensating control on systems where the patch cannot be immediately applied, removing the SUID bit from the ntfs-3g binary ('chmod -s /usr/bin/ntfs-3g') prevents privilege escalation by requiring root to explicitly invoke the binary, though this breaks unprivileged NTFS mounting via FUSE and may disrupt desktop automount workflows. Alternatively, blocking automounting of removable media via udisks2 policy reduces the attack surface for physical-access scenarios, at the cost of requiring manual root-level mounting. Restricting physical access and disabling USB automount are complementary controls for environments that cannot patch immediately.