CVE-2026-90132 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ntfs: reject unprivileged writes to reserved $LX* xattrs
Reject setxattr of the reserved $LXUID, $LXGID, $LXMOD and $LXDEV names from userspace unless the caller has CAP_SYS_ADMIN.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's NTFS filesystem driver contains a critical access control flaw related to extended attributes associated with POSIX permissions emulation. Specifically, the vulnerability involves the handling of reserved attribute names such as LXUID, LXGID, LXMOD, and LXDEV within the $LX* namespace. These special xattrs are used by the ntfs3 driver to map Windows security identifiers and permission bits to Linux user IDs, group IDs, mode permissions, and device numbers respectively. The core technical flaw lies in the insufficient privilege checking during setxattr operations performed from userspace. Prior to this resolution, any unprivileged process could invoke system calls like setxattr or fsetxattr to modify these reserved attributes without possessing the CAP_SYS_ADMIN capability. This lack of enforcement allows a local user to arbitrarily alter how files are perceived by the Linux kernel in terms of ownership and permissions, effectively bypassing standard Unix permission checks that rely on UID, GID, and mode bits derived from these extended attributes.
From an operational impact perspective, this vulnerability enables privilege escalation and integrity violations within the NTFS filesystem context. An attacker with local access to a mounted NTFS partition can manipulate file metadata to impersonate root or other privileged users by setting LXUID and LXGID values that correspond to high-privilege accounts. Furthermore, modifying LXMOD allows an attacker to change file permissions, potentially granting read, write, or execute rights to sensitive files that were previously restricted. This undermines the fundamental security model of multi-user systems where filesystem integrity is paramount. The ability to alter these attributes without administrative oversight means that standard sandboxing mechanisms and user isolation policies are rendered ineffective for data stored on NTFS volumes managed by this driver.
This issue aligns with CWE-269, which classifies Improper Privilege Management, as the system fails to enforce appropriate privileges when performing security-critical operations. It also relates to CWE-732, where incorrect permission assignment allows unauthorized access or modification of resources. In terms of adversarial tactics, this vulnerability supports techniques found in MITRE ATT&CK such as T1055 Process Injection and T1068 Exploitation for Privilege Escalation, specifically through the manipulation of file attributes to gain higher-level access. The flaw represents a classic case where filesystem-specific implementation details are not adequately gated by general kernel security policies designed to protect system integrity.
To mitigate this vulnerability, it is essential that systems running affected versions of the Linux kernel with NTFS support be updated immediately. Administrators should ensure that all ntfs3 drivers comply with the patch which explicitly checks for CAP_SYS_ADMIN before allowing writes to reserved $LX* attributes. In environments where immediate patching is not feasible, restricting access to NTFS partitions via mount options or using mandatory access control systems like SELinux or AppArmor can provide an additional layer of defense by limiting which processes are allowed to perform extended attribute modifications on specific filesystems. Regular auditing of file permission changes and monitoring for unusual setxattr calls in system logs can also help detect potential exploitation attempts before significant damage occurs.