CVE-2023-0386: Linux kernel OverlayFS setuid copy privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityLocal privilege escalation to root with confirmed active exploitation in CISA KEV, though it requires an existing local account.

What it is

A uid mapping bug in the Linux kernel OverlayFS subsystem lets a local user copy a file with capabilities from a nosuid mount into another mount, bypassing the intended restriction on setuid execution. Because the copied file retains its capabilities, an unprivileged local user can gain elevated privileges on the host.

Impact

An attacker with a local account gains root-level privileges on the affected system, enabling full control of the host, data access and further lateral movement.

Attack surface

Reached locally through OverlayFS mount operations; the CVSS vector (AV:L/PR:L/UI:N) indicates a low-privileged local user is required and no user interaction is needed. No remote or network vector is described.

Exploitation

CVE-2023-0386 is listed in CISA KEV (added 2025-06-17), confirming active exploitation; EPSS 30-day probability is 0.0788 (94th percentile). No ransomware campaign use is documented.

What to do

• Apply the kernel patch referenced in the git.kernel.org commit and vendor advisories (Debian DSA-5402, NetApp, Canonical) as the first action.
• Update to a fixed kernel version per your distribution's advisory; do not rely on version numbers not stated in the record.
• Restrict local shell access and limit unprivileged user accounts on hosts where OverlayFS is enabled.
• Where patching is not immediately possible, follow vendor mitigation guidance or discontinue use of the affected product per CISA BOD 22-01.
• Track KEV remediation due date of 2025-07-08 for any remaining exposed systems.

Detection

• Monitor for unexpected creation or execution of setuid/capability-bearing files in overlay or user-writable mount paths.
• Alert on privilege escalation attempts involving OverlayFS mount and copy operations by non-root users.
• Audit for new root-owned processes or shells spawned from unprivileged user sessions.
• Review kernel and audit logs for overlayfs mount activity correlated with local user accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.