CVE-2026-63833: Linux Kernel Privilege Escalation Flaw

CVE-2026-63833 Overview

CVE-2026-63833 is a local privilege escalation vulnerability in the Linux kernel's ntfs3 filesystem driver. The flaw allows unprivileged users on a writable ntfs3 mount to write directly to reserved $LXUID, $LXGID, $LXMOD, and $LXDEV extended attributes. These xattrs store Windows Subsystem for Linux (WSL) permission metadata that ntfs3 reloads into i_uid, i_gid, and i_mode via ntfs_get_wsl_perm(). An attacker can plant root ownership and the S_ISUID bit on their own file, then gain effective UID 0 after inode reload.

Critical Impact
Local unprivileged users on writable ntfs3 mounts can escalate to root by manipulating reserved WSL permission xattrs to obtain setuid binaries owned by root.

Affected Products

Linux kernel with the ntfs3 driver enabled
Systems mounting NTFS volumes read-write via ntfs3
Distributions shipping vulnerable stable kernel branches prior to the referenced patches

Discovery Timeline

2026-07-19 - CVE-2026-63833 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63833

Vulnerability Analysis

The ntfs3 driver treats $LXUID, $LXGID, $LXMOD, and $LXDEV as internal metadata storing WSL-style POSIX ownership and mode bits. During inode operations, ntfs_get_wsl_perm() reads these xattrs and copies their values into the inode's in-memory i_uid, i_gid, and i_mode fields. The driver registers an empty-prefix xattr handler that also exposes these names through the standard setxattr(2) interface. File owners can therefore write directly to these reserved names without any privilege check.

An unprivileged attacker who owns a file on a writable ntfs3 mount can call setxattr() on their own binary to set $LXUID=0, $LXGID=0, and $LXMOD to a value containing S_ISUID and executable bits. After the inode is reloaded from disk, the kernel treats the binary as a root-owned setuid executable. Executing the file yields effective UID 0.

Root Cause

The empty-prefix xattr handler in ntfs3 did not filter reserved $LX* names. It relied only on ordinary file-owner permission checks rather than restricting writes to internal metadata. This is a broken access control flaw in a kernel filesystem driver [CWE-284] combined with improper input validation of xattr names.

Attack Vector

Exploitation requires local access, low privileges, and a writable ntfs3 mount. The attacker creates or owns a file on the NTFS volume, invokes setxattr() with the reserved $LXUID, $LXGID, and $LXMOD names, forces an inode reload, and then executes the file to inherit root privileges. No user interaction is required.

The upstream fix rejects direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates continue to work because ntfs_save_wsl_perm() writes via ntfs_set_ea() directly, bypassing the xattr handler entry point. An additional check for non-privileged users was added by the maintainer.

Detection Methods for CVE-2026-63833

Indicators of Compromise

Unexpected setuid or setgid files on ntfs3-mounted volumes owned by root but residing in user-writable directories
setxattr(2) syscalls from unprivileged processes targeting names beginning with $LX on ntfs3 mounts
Shell processes running with euid=0 spawned by users who do not have sudo privileges
New root-owned binaries appearing on removable NTFS media shortly after user activity

Detection Strategies

Audit setxattr and lsetxattr syscalls with auditd rules filtering for xattr names matching $LX* on ntfs3 filesystems
Monitor for euid transitions to 0 originating from execve of binaries on ntfs3 mount points
Enumerate setuid binaries on all ntfs3 mounts and compare against a known baseline
Track inode i_uid/i_mode changes on removable and secondary NTFS volumes

Monitoring Recommendations

Enable kernel audit logging for filesystem xattr operations on non-root filesystems
Alert on execve events where the executable path resides on an ntfs3 mount and the effective UID changes to 0
Correlate mount events for ntfs3 with subsequent setxattr activity from non-root users
Review kernel version inventory to identify hosts running vulnerable ntfs3 builds

How to Mitigate CVE-2026-63833

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD advisory as soon as vendor builds are available
Mount NTFS volumes read-only where write access is not required, using mount -o remount,ro
Restrict use of the ntfs3 driver on multi-user systems until patched kernels are deployed
Audit existing NTFS volumes for setuid binaries with unexpected root ownership

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Relevant commits include 293a84f, 2c3cd6d, 5b08dcc, 5e658b9, e574af9, e8852ae, and f8d4209. The patch rejects direct userspace writes to reserved $LX* xattr names while preserving internal metadata updates through ntfs_set_ea().

Workarounds

Disable the ntfs3 kernel module on systems that do not require NTFS write access: modprobe -r ntfs3 and blacklist via /etc/modprobe.d/
Mount NTFS volumes with the nosuid option to neutralize setuid bits: mount -o nosuid,remount /mnt/ntfs
Prevent unprivileged users from mounting removable NTFS media by tightening udisks2 and polkit rules
Use noexec on ntfs3 mounts where executables are not needed

bash

# Configuration example
# /etc/fstab entry hardening for ntfs3 volumes
UUID=<uuid>  /mnt/data  ntfs3  defaults,nosuid,nodev,noexec  0 0

# Blacklist ntfs3 if not required
echo 'blacklist ntfs3' | sudo tee /etc/modprobe.d/disable-ntfs3.conf
sudo update-initramfs -u

# Audit rule for suspicious xattr writes
sudo auditctl -a always,exit -F arch=b64 -S setxattr -S lsetxattr -k ntfs3_lx_xattr