The Linux kernel ntfs3 driver used certain extended attributes ($LXUID, $LXGID, $LXMOD, $LXDEV) as internal metadata for WSL permissions, reloading them into inode ownership and mode fields. However, the xattr handler allowed file owners to call setxattr() directly on these reserved names, enabling unprivileged users on writable ntfs3 mounts to escalate privileges by planting root ownership and the S_ISUID bit on files. The fix rejects direct userspace writes to these reserved $LX* xattrs, preventing this privilege escalation vector. Internal metadata updates remain functional via direct kernel calls.

An unprivileged user with write access to an ntfs3 filesystem could escalate privileges to effective root (euid 0) by exploiting the ability to write reserved extended attributes that control inode ownership and mode. This could lead to unauthorized root-level access on the affected system.

A fix has been implemented in the Linux kernel ntfs3 driver to reject direct userspace writes to the reserved $LX* extended attributes. Users should apply the official kernel update containing this fix to mitigate the vulnerability. No additional mitigation steps are indicated in the advisory.