CVE-2026-63833

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ntfs3 driver where the empty-prefix xattr handler allows file owners to call setxattr() directly on reserved xattrs used as internal WSL permission metadata, specifically $LXUID, $LXGID, $LXMOD, and $LXDEV. An unprivileged writer on a writable ntfs3 mount can exploit this to plant root ownership and S ISUID on their own files, allowing them to gain euid 0 (root privileges) after an inode reload. Inode reload is the process where the kernel refreshes the file's metadata from the disk into memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.