The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV     as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from     ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these     names directly, an unprivileged writer on a writable ntfs3 mount can plant root ownership and S_ISUID on     their own file and gain euid 0 after inode reload. Reject direct userspace writes to the reserved $LX*     names. Internal ntfs3 metadata updates are unchanged because ntfs_save_wsl_perm() writes them via     ntfs_set_ea() directly. [almaz.alexandrovich@paragon-software.com: added an additional check for non     privileged users] (CVE-2026-63833)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-63833

high Nessus Plugin ID 327894

Version 1.24