A vulnerability in the Linux kernel NTFS driver allows local authenticated users to perform unauthorized attribute modifications, presenting a significant risk of privilege escalation.

The Linux kernel NTFS implementation improperly validates user-supplied input when setting extended attributes. An authenticated local attacker can leverage this flaw to write to reserved attributes (such as $LXUID or $LXGID) without the required CAP_SYS_ADMIN privileges.

Successful exploitation allows a local user with low privileges to manipulate file ownership and permissions, effectively bypassing system security controls. Given the CVSS score of 7.1, this vulnerability poses a high risk to data integrity and system confidentiality. Compromise of these attributes can lead to full administrative access on the local host or unauthorized modification of sensitive system files.

Immediate Action: Update the Linux kernel to version 7.2.6 or later, which contains the necessary validation logic to restrict access to reserved NTFS extended attributes.

Proactive Monitoring: Monitor system logs for unusual setxattr calls or attempts by unauthorized users to manipulate extended attributes on NTFS-formatted volumes.

Compensating Controls: Restrict access to NTFS-formatted partitions for untrusted local users and ensure that kernel hardening features are enabled to limit the potential impact of local privilege escalation attempts.

Public Exploit Available: Unknown

The ability for a low-privileged user to modify reserved kernel-level attributes is a serious security regression. Organizations running Linux systems with NTFS support should prioritize updating their kernels to version 7.2.6 immediately to eliminate this vector for privilege escalation. Failure to patch may allow attackers who have gained initial local access to elevate their permissions and compromise the integrity of the entire system.