InjectionBunny: NTFS3 SUID Injection LPE
Summary
InjectionBunny details a local privilege escalation in Linux ntfs3 driven by on-disk extended attributes being assigned to inode mode without masking. A crafted NTFS image or USB drive can cause a setuid root binary to appear when mounted, enabling root execution. The article notes CVE-2026-63833 as related and recommends masking S_ISUID and S_ISGID in the kernel code as the mitigation.