CVE-2023-0386
HighExploitedPublic exploitA flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount.
Published Jul 10, 2023 · Updated Aug 12, 2026 · Also known as DEBIAN-CVE-2023-0386, DLA-3446-1, DSA-5402-1, LSN-0095-1, SUSE-SU-2023:2368-1, SUSE-SU-2023:2369-1, SUSE-SU-2023:2371-1, SUSE-SU-2023:2384-1, SUSE-SU-2023:2425-1, SUSE-SU-2023:2428-1, SUSE-SU-2023:2431-1, SUSE-SU-2023:2443-1, SUSE-SU-2023:2455-1, SUSE-SU-2023:2459-1, SUSE-SU-2023:2468-1, TR-23-0321, UBUNTU-CVE-2023-0386, UBUNTU-CVE-2023-1380, UBUNTU-CVE-2023-1872, UBUNTU-CVE-2023-2612, UBUNTU-CVE-2023-31436, UBUNTU-CVE-2023-32233, USN-6043-1, USN-6072-1
Key Facts
Patch immediately- CVE-2023-0386 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Ubuntu Linux (Canonical), Debian Linux, Linux Kernel and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 17, 2025. Public exploit code is available.
- EPSS estimates a 7.9% probability of exploitation in the next 30 days.
- Fixed versions are available, including bpftool 4.18.0-425.19.2.el8_7, bpftool 5.14.0-162.23.1.el9_1, bpftool NA.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
7.9%
Higher than 94.6% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2023-0386 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jun 17, 2025 | Jul 8, 2025 | Not reported |
| Industry KEV feed | Jun 17, 2025 | Jul 8, 2025 | Not reported |
| CIRCL KEV | Jun 17, 2025 | Jul 8, 2025 | Not reported |
| ENISA EUVD | Jun 17, 2025 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Products
469 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Ubuntu LinuxCanonical | 18.04, 20.04, 22.04 | n/a |
| Debian LinuxDebian | 10.0 | n/a |
| Linux KernelLinux | 6.2-rc1, 6.2-rc2, 6.2-rc3, 6.2-rc4, 6.2-rc5 | 5.15.91 |
| H300s FirmwareNetapp | See advisory | n/a |
| H410c FirmwareNetapp | See advisory | n/a |
Patched Releases
bpftool
4.18.0-425.19.2.el8_7, 5.14.0-162.23.1.el9_1, NA
cluster-md-kmp-64kb
5.14.21-150400.24.63.1
cluster-md-kmp-azure
5.14.21-150400.14.49.1
cluster-md-kmp-default
5.14.21-150400.24.63.1
cluster-md-kmp-rt
5.14.21-150400.15.28.2, 5.14.21-150500.13.5.1
dlm-kmp-64kb
5.14.21-150400.24.63.1
dlm-kmp-azure
5.14.21-150400.14.49.1
dlm-kmp-default
5.14.21-150400.24.63.1
dlm-kmp-rt
5.14.21-150400.15.28.2, 5.14.21-150500.13.5.1
dtb-aarch64
5.14.21-150400.24.63.1
dtb-allwinner
5.14.21-150400.24.63.1
dtb-altera
5.14.21-150400.24.63.1
dtb-amazon
5.14.21-150400.24.63.1
dtb-amd
5.14.21-150400.24.63.1
dtb-amlogic
5.14.21-150400.24.63.1
dtb-apm
5.14.21-150400.24.63.1
dtb-apple
5.14.21-150400.24.63.1
dtb-arm
5.14.21-150400.24.63.1
dtb-broadcom
5.14.21-150400.24.63.1
dtb-cavium
5.14.21-150400.24.63.1
dtb-exynos
5.14.21-150400.24.63.1
dtb-freescale
5.14.21-150400.24.63.1
dtb-hisilicon
5.14.21-150400.24.63.1
dtb-lg
5.14.21-150400.24.63.1
dtb-marvell
5.14.21-150400.24.63.1
Timeline
Publicly disclosed
Jul 10, 2023
Added to CISA KEV
Jun 17, 2025
Added to Industry KEV feed
Jun 17, 2025
Added to CIRCL KEV
Jun 17, 2025
Added to ENISA EUVD
Jun 17, 2025
Last updated
Aug 12, 2026
Weakness Type
- CWE-282 Improper Ownership Management
References
- advisoryhttp://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
- advisoryRHSA-2023:1554
- advisoryRHSA-2023:1566
- advisoryRHSA-2023:1584
- advisoryRHSA-2023:1659
FAQ
Common Questions.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount.
Affected: Ubuntu Linux (Canonical) versions 18.04, 20.04, 22.04; Debian Linux versions 10.0; Linux Kernel versions 6.2-rc1, 6.2-rc2, 6.2-rc3, 6.2-rc4, 6.2-rc5, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 17, 2025.
Yes. It was added on Jun 17, 2025 with a federal remediation due date of Jul 8, 2025.
Public exploit code is available.
Fixed versions are available, including bpftool 4.18.0-425.19.2.el8_7, bpftool 5.14.0-162.23.1.el9_1, bpftool NA.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2023-0386 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo