HackerFeeds
All CVEs

CVE-2023-0386

HIGH7.8
CISA KEV

Published 2023-03-22 · Updated 2026-06-17 · Source secalert@redhat.com

Summary

CVE-2023-0386 is a high-severity (CVSS 7.8) vulnerability in Linux Kernel. CISA added it to the Known Exploited Vulnerabilities catalog on June 17, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 8, 2025. CISA does not currently list it as used in ransomware campaigns. Linux has 32 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

All 32 known-exploited Linux vulnerabilities →

Description

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-282

CISA Known-Exploited Vulnerability

Product: Linux — Kernel

Name: Linux Kernel Improper Ownership Management Vulnerability

Date added: 2025-06-17 · Due: 2025-07-08

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

View on NVD