Secuno
ENNL
Book demo

CVE-2023-0386

Linux Kernel Improper Ownership Management

7.8 HIGHActively exploited (CISA KEV)EPSS 7.88%
  1. Published22 Mar 2023
  2. Added to CISA KEV17 Jun 2025
  3. Remediation due8 Jul 2025
Actively exploited (CISA KEV)

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Added to KEV: 17 Jun 2025Federal remediation due: 8 Jul 2025

Description

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Canonical Ubuntu Linux18.04 · 20.04 · 22.04
Debian Linux10.0
Linux Kernel≥ 5.11 < 5.15.91 · ≥ 5.16 < 6.1.9 · 6.2
Netapp H300s Firmwareall versions
Netapp H410c Firmwareall versions
Netapp H410s Firmwareall versions
Netapp H500s Firmwareall versions
Netapp H700s Firmwareall versions

Remediation

Fixed in
Linux Kernel≥ 5.15.91

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-501308.8
Pi-hole is a DNS sinkhole that protects devices from unwanted content without…
CVE-2026-235148.8
Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core…
CVE-2025-272548.0
CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows…

Frequently asked

Is CVE-2023-0386 being actively exploited?

Yes. CVE-2023-0386 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 17 Jun 2025.

How severe is CVE-2023-0386?

CVE-2023-0386 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 7.88% probability of exploitation.

Which products are affected by CVE-2023-0386?

Affected products include Canonical Ubuntu Linux, Debian Linux, Linux Kernel, Netapp H300s Firmware, Netapp H410c Firmware, and 3 more.

How do I fix CVE-2023-0386?

Upgrade affected software to a fixed version, for example Linux Kernel 5.15.91 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-0386 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.