Homepage

Improperly Controlled Modification of Dynamically-Determined Object Attributes Affecting kernel6.18-tools-devel package, versions <1:6.18.38-73.137.amzn2023

Severity

 Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.13% (3rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-KERNEL618TOOLSDEVEL-18905841
  • published18 Aug 2026
  • disclosed19 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Jul 2026

CVE-2026-63833  (opens in a new tab)
CWE-915  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel6.18-tools-devel to version 1:6.18.38-73.137.amzn2023 or higher.
This issue was patched in ALAS2023-2026-1969.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel6.18-tools-devel package and not the kernel6.18-tools-devel package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: reject direct userspace writes to reserved $LX* xattrs

NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm().

Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on their own file and gain euid 0 after inode reload.

Reject direct userspace writes to the reserved $LX* names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via ntfs_set_ea() directly.

[almaz.alexandrovich@paragon-software.com: added an additional check for non privileged users]