Linux Kernel OverlayFS Privilege Escalation (CVE-2023-0386)

Historical catalog analysis: CISA added this entry on June 17, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2023-0386 is an improper ownership management vulnerability (CWE-282) located within the OverlayFS subsystem of the Linux Kernel. The flaw exists in how the kernel handles the copying of a capable file from a mount configured with nosuid into another mount. This UID mapping error allows a local user to execute setuid files with capabilities, resulting in local privilege escalation.

Exposure and applicability

This vulnerability affects systems running the Linux Kernel that utilize the OverlayFS subsystem. Because OverlayFS is a common component used across various distributions and cloud environments, exposure is widespread among infrastructure owners utilizing containerization or layered file systems. The risk is specifically applicable to environments where local users have the ability to perform file operations between mounts with differing nosuid configurations.

Remediation priorities

Our analysis suggests prioritizing remediation based on the following hierarchy:

1. Patch Application: Apply vendor-specific kernel updates that address the UID mapping bug in OverlayFS. This is the primary method for reducing exposure.
2. Cloud Service Alignment: For organizations utilizing cloud services, we recommend aligning with BOD 22-01 guidance to ensure provider-managed kernels are updated.
3. Component Decommissioning: In scenarios where a vendor patch is unavailable or cannot be applied due to legacy constraints, the use of the affected product or subsystem should be discontinued to eliminate the attack vector.

How to validate remediation

Verification must go beyond simple version checks, as kernel versions vary by distribution and backported patches may be present. To verify that exposure has been reduced, defenders should:

• Confirm Patch Integration: Cross-reference the installed kernel build with the specific vendor security advisory (e.g., Red Hat or NetApp) to ensure the fix for CVE-2023-0386 is active.
• Verify Subsystem State: Confirm whether OverlayFS is enabled and if the specific conditions allowing the UID mapping error are still present in the current environment.

Limits and open questions

While patching reduces the likelihood of exploitation, residual risk remains if unauthorized local access is maintained through other vectors. It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Furthermore, because this affects a common open-source component, the exact version ranges across all third-party distributions may vary, requiring individual vendor verification.

Source and editorial note

CVE-2023-0386: Linux Kernel Improper Ownership Management Vulnerability · Source date: June 17, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: June 20, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 11, 2026 at 00:12 UTC.

Request a Vulnerability Assessment