Skip to main content

Linux Kernel EUVDEUVD-2026-45499

| CVE-2026-63833 HIGH
2026-07-19 Linux GHSA-wv5h-jx62-4xcv
Information Disclosure Linux
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.8 HIGH

Local low-priv file owner (AV:L/PR:L) exploits it trivially (AC:L/UI:N); reaching euid 0 grants full system control, so C:H/I:H and A:H rather than the vendor's A:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:48 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.1 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 7.1
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: reject direct userspace writes to reserved $LX* xattrs

NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm().

Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload.

Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly.

[almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]

AnalysisAI

Local privilege escalation in the Linux kernel NTFS3 filesystem driver allows an unprivileged user with a file on a writable ntfs3 mount to set the reserved $LXUID, $LXGID, $LXMOD and $LXDEV WSL-permission xattrs directly via setxattr(), planting root ownership and the S_ISUID bit on their own file so it executes with euid 0. The empty-prefix xattr handler failed to block userspace writes to these internal metadata names, which ntfs_get_wsl_perm() reloads into i_uid/i_gid/i_mode on inode reload. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the issue is not on CISA KEV, but the outcome is full local root.

Technical ContextAI

The NTFS3 driver (in-tree since kernel 5.15) implements Microsoft's WSL interoperability by storing POSIX ownership and permission metadata inside NTFS extended attributes named $LXUID, $LXGID, $LXMOD and $LXDEV. On inode load, ntfs_get_wsl_perm() copies these values into the VFS inode fields i_uid, i_gid and i_mode. The root cause is a trust boundary failure (a CWE-269/CWE-284 class improper-privilege/access-control issue; the input lists CWE as N/A): the generic empty-prefix xattr handler exposed these internal names to ordinary setxattr() calls from a file's owner, so attacker-controlled data was treated as trusted kernel-internal permission metadata. The fix rejects direct userspace writes to the reserved $LX* names while leaving legitimate internal updates intact because ntfs_save_wsl_perm() writes them through ntfs_set_ea() directly rather than through the xattr handler. CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38 or 7.1.3 (or 7.2-rc1) as appropriate for your branch, applying your distribution's corresponding backport as soon as it ships. The fix is delivered as upstream stable commits (e.g. https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909); track your distro advisory for the exact packaged version. Where immediate patching is not possible, the concrete compensating control is to eliminate the exposure: avoid mounting ntfs3 volumes writable by untrusted local users - mount such volumes read-only, or restrict them with uid=/gid= and appropriate ownership so untrusted accounts cannot create files on them, and unload/blacklist the ntfs3 module on systems that do not need NTFS support. Trade-offs: read-only or restricted mounts break legitimate write workflows to NTFS media, and blacklisting ntfs3 disables all NTFS access, so apply these only on hosts where NTFS write access by ordinary users is not required.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45499 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy