Riskcovery

CVE-2026-90132

ntfs: reject unprivileged writes to reserved $LX* xattrs

State
Published
Severity
7.1 High
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject unprivileged writes to reserved $LX* xattrs

Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAP_SYS_ADMIN.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • fc053f05ca282a5e760b41f6560ac835c4e28037 to before 86f46508016bc1f2bffb3a52dc2664f942fb9802Affected
  • fc053f05ca282a5e760b41f6560ac835c4e28037 to before ea6a67ef64451d2da298f15baa35865b4bb6372aAffected
LinuxLinux
  • 7.1Affected
  • before 7.1Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.