--- title: Specially Crafted NTFS File-System Image Allows Root... description: A privilege escalation vulnerability in the Linux NTFS3 kernel driver allows a specially crafted NTFS filesystem image, such as one on a USB drive, to create a... canonical: https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver | daily.dev og:description: A privilege escalation vulnerability in the Linux NTFS3 kernel driver allows a specially crafted NTFS filesystem image, such as one on a USB drive, to create a... og:url: https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra og:image: https://api.daily.dev/og/posts/E4YQXmyra.png og:image:alt: Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver **[Phoronix](https://daily.dev/sources/phoronix)** · 2 min read · 3 upvotes · 1 comments ## Summary A privilege escalation vulnerability in the Linux NTFS3 kernel driver allows a specially crafted NTFS filesystem image, such as one on a USB drive, to create a setuid-root binary the moment the volume is mounted. Discovered by Vova Tokarev, the flaw stems from fs/ntfs3/xattr.c directly loading S_ISUID/S_ISGID mode bits from untrusted on-disk extended attribute data. Because desktop automounters like udisks mount NTFS with suid by default, plugging in a malicious drive can grant any local user root access. The issue was reported privately two months prior and remains unpatched in mainline as of the disclosure, though a one-line fix has been suggested. The newer NTFS driver alternative in the kernel tree is reportedly unaffected. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the NTFS3 driver vulnerability that lets a USB drive grant root access on Linux? A crafted NTFS filesystem image with extended attributes $LXUID=0, $LXGID=0, and $LXMOD=0104755 already written into the MFT creates a setuid-root binary the moment the volume is mounted, no setxattr() call needed. Desktop automounters like udisks mount NTFS with suid by default, so plugging in the crafted USB grants any local user euid=0. Discovered by Vova Tokarev, the bug remains unpatched in mainline as of disclosure. _Kernel maintainers tracking unpatched filesystem CVEs can follow driver security fixes on daily.dev._ ### Where in the NTFS3 driver source code does the setuid privilege escalation bug live? The flaw sits at fs/ntfs3/xattr.c line 1022, where inode->i_mode is assigned directly from le32_to_cpu(value[2]), loading S_ISUID and S_ISGID bits straight from untrusted on-disk extended attribute data. The suggested one-line fix masks out those bits with a bitwise AND against ~(S_ISUID | S_ISGID) before assignment, but this fix had not been merged into the mainline driver as of the report. _Anyone patching kernel filesystem drivers can track NTFS3 fixes and mailing list activity via daily.dev._ ### Does the new Linux NTFS driver replacement have the same privilege escalation flaw as NTFS3? No, the newer alternative NTFS driver being developed within the mainline kernel tree does not appear to be impacted by the NTFS3 setuid extended attribute privilege escalation bug. The issue is specific to fs/ntfs3/xattr.c in the existing NTFS3 driver, which loads untrusted on-disk mode bits including setuid and setgid without masking them out. _Developers choosing between Linux NTFS drivers can weigh security tradeoffs by following kernel filesystem news on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@akkitto** · 1 upvotes > This is, why you have to keep your system up to date. ## Similar posts on daily.dev - [NTFS-3G Update Brings Many Security Fixes](https://daily.dev/posts/ntfs-3g-update-brings-many-security-fixes-riwlbpbes) · Phoronix · 0 upvotes · 0 comments - [CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root](https://daily.dev/posts/cve-2026-3888-important-snap-flaw-enables-local-privilege-escalation-to-root-8tdjfcx77) · Hacker News · 0 upvotes · 0 comments - [New NTFS Driver Sees Hardening & Fixes, Windows Native Symlinks With Linux 7.2](https://daily.dev/posts/new-ntfs-driver-sees-hardening-fixes-windows-native-symlinks-with-linux-7-2-c8jw6a9d7) · Phoronix · 1 upvotes · 0 comments - [What is NTFSPlus and Why Does It Matter for Linux Users?](https://daily.dev/posts/what-is-ntfsplus-and-why-does-it-matter-for-linux-users--abhe55p2j) · It's Foss · 1 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver","url":"https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra"},"datePublished":"2026-08-22T12:47:06.323Z","dateModified":"2026-09-14T06:06:22.233Z","description":"A privilege escalation vulnerability in the Linux NTFS3 kernel driver allows a specially crafted NTFS filesystem image, such as one on a USB drive, to create a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78eb4e7db94aa8d714d7cd6a9ba6659f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78eb4e7db94aa8d714d7cd6a9ba6659f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Phoronix","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Phoronix","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6a26ba379dd64932830aa0c9803dd7ee","url":"https://daily.dev/sources/phoronix"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"linux","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Phoronix","item":"https://daily.dev/sources/phoronix"},{"@type":"ListItem","position":3,"name":"Specially Crafted NTFS File-System Image Allows Root Access On Linux With NTFS3 Driver"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra","comment":[{"@type":"Comment","text":"This is, why you have to keep your system up to date.","datePublished":"2026-08-22T15:11:45.517Z","url":"https://daily.dev/posts/E4YQXmyra#c-Qd1ADNam7","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/specially-crafted-ntfs-file-system-image-allows-root-access-on-linux-with-ntfs3-driver-e4yqxmyra#faq","mainEntity":[{"@type":"Question","name":"What is the NTFS3 driver vulnerability that lets a USB drive grant root access on Linux?","acceptedAnswer":{"@type":"Answer","text":"A crafted NTFS filesystem image with extended attributes $LXUID=0, $LXGID=0, and $LXMOD=0104755 already written into the MFT creates a setuid-root binary the moment the volume is mounted, no setxattr() call needed. Desktop automounters like udisks mount NTFS with suid by default, so plugging in the crafted USB grants any local user euid=0. Discovered by Vova Tokarev, the bug remains unpatched in mainline as of disclosure. Kernel maintainers tracking unpatched filesystem CVEs can follow driver security fixes on daily.dev."}},{"@type":"Question","name":"Where in the NTFS3 driver source code does the setuid privilege escalation bug live?","acceptedAnswer":{"@type":"Answer","text":"The flaw sits at fs/ntfs3/xattr.c line 1022, where inode->i_mode is assigned directly from le32_to_cpu(value[2]), loading S_ISUID and S_ISGID bits straight from untrusted on-disk extended attribute data. The suggested one-line fix masks out those bits with a bitwise AND against ~(S_ISUID | S_ISGID) before assignment, but this fix had not been merged into the mainline driver as of the report. Anyone patching kernel filesystem drivers can track NTFS3 fixes and mailing list activity via daily.dev."}},{"@type":"Question","name":"Does the new Linux NTFS driver replacement have the same privilege escalation flaw as NTFS3?","acceptedAnswer":{"@type":"Answer","text":"No, the newer alternative NTFS driver being developed within the mainline kernel tree does not appear to be impacted by the NTFS3 setuid extended attribute privilege escalation bug. The issue is specific to fs/ntfs3/xattr.c in the existing NTFS3 driver, which loads untrusted on-disk mode bits including setuid and setgid without masking them out. Developers choosing between Linux NTFS drivers can weigh security tradeoffs by following kernel filesystem news on daily.dev."}}]} ```