The flaw allows a non‑privileged user who can write to an NTFS3 filesystem to directly set the internal extended attribute names $LXUID, $LXGID, $LXMOD, and $LXDEV via setxattr(). These attributes are loaded as the inode’s owner, group, and mode when the kernel processes the file. Because the kernel previously accepted writes to these names from user space, an attacker can assign the values that correspond to root ownership and the setuid bit, and gain effective UID 0 the next time the inode is accessed. The vulnerability is a local privilege‑elevation flaw, giving the attacker full control over the host system.

The issue is present in the Linux kernel’s NTFS3 filesystem implementation for any kernel version that has not yet incorporated the commit that rejects direct writes to the $LX* extended attribute names. No specific kernel version range is listed in the data, so all kernels lacking the patch are considered vulnerable.

The CVSS score is 7.1, which indicates a moderate to high severity for a local exploit. The EPSS score of less than 1 % shows that expected exploitation probability is low, and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to have write access to a file on an NTFS3‑mounted partition and to invoke setxattr() on one of the reserved attribute names. Once these conditions are met, the attacker becomes root on the host without needing additional kernel exploits.