Linux Kernel Vulnerability Affects NTFS3 from Paragon Software

CVE-2026-63833

What is CVE-2026-63833?

A vulnerability has been identified in the NTFS3 component of the Linux kernel, allowing unprivileged users to write directly to reserved extended attributes ($LXUID, $LXGID, $LXMOD, and $LXDEV). This can lead to unauthorized elevation of privileges, as a malicious actor could manipulate file ownership and permissions on a writable NTFS3 mount, thereby executing code with elevated privileges. Internal metadata updates remain secure since they utilize controlled methods. The vulnerability has been addressed by enforcing restrictions on direct user writes to the specified metadata attributes.

References