CVE-2023-0386: Linux Kernel Improper Ownership Management Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-06-17
EPSS: 7.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-22 · updated 2026-06-17
Weakness: CWE-282

Description

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Affected products

Canonical Ubuntu Linux: 18.04, 20.04, 22.04
Debian Linux: 10.0
Linux kernel: from 5.11 before 5.15.91; from 5.16 before 6.1.9; 6.2-rc1, 6.2-rc2, 6.2-rc3, 6.2-rc4, 6.2-rc5 — fixed in 5.15.91, 6.1.9
NetApp H300S Firmware: all versions
NetApp H410C Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700S Firmware: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.15.91, 6.1.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-0386 or the next vulnerability affects your stack