In the Linux kernel, the following vulnerability has been resolved:

ntfs3: reject direct userspace writes to reserved $LX* xattrs

NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL
permission metadata and reloads them into i_uid, i_gid and i_mode
from ntfs_get_wsl_perm().

Because the empty-prefix xattr handler also lets file owners call
setxattr() on these names directly, an unprivileged writer on a
writable ntfs3 mount can plant root ownership and S_ISUID on their own
file and gain euid 0 after inode reload.

Reject direct userspace writes to the reserved $LX* names. Internal
ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm()
writes them via ntfs_set_ea() directly.

[[email protected]: added an additional check for non privileged users]

https://git.kernel.org/stable/c/293a84fa40b3a1b3471c0545722724bc10973f76

https://git.kernel.org/stable/c/2c3cd6da4a14380ef79e34bd9dff7caf46687477

https://git.kernel.org/stable/c/5b08dccecf825cbf905f348bc6ccb497507e28e2

https://git.kernel.org/stable/c/5e658b9245a52d838ef93729a7bc07de8e19deb7

https://git.kernel.org/stable/c/e574af95234afc3c725988bbc1fdeb46b9f386a4

https://git.kernel.org/stable/c/e8852ae29868e449fdb47eebc28f35fb80741a5f

https://git.kernel.org/stable/c/f8d420949b335a4b51d06ab276beee6b8dfdc909

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e574af95234afc3c725988bbc1fdeb46b9f386a4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2c3cd6da4a14380ef79e34bd9dff7caf46687477","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e8852ae29868e449fdb47eebc28f35fb80741a5f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f8d420949b335a4b51d06ab276beee6b8dfdc909","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5e658b9245a52d838ef93729a7bc07de8e19deb7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"293a84fa40b3a1b3471c0545722724bc10973f76","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5b08dccecf825cbf905f348bc6ccb497507e28e2","versionType":"git","status":"affected"},{"version":"0","lessThan":"5.15.211","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.1.177","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.6.144","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.12.95","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.18.38","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.1.3","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15.211","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.177","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]