---
id: "CVE-2021-3493"
kind: "vulnerability"
aliases: ["CVE-2021-3493"]
title: "canonical ubuntu linux: The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the\u2026"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": ["18.04"], "affected": "< 18.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": ["20.04"], "affected": ">= 18.04.1, < 20.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": ["20.10"], "affected": "< 20.10", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "kubernetes", "linux", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2021-04-17T05:15:14+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3493", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3493", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# canonical ubuntu linux: The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the…

The overlayfs file system in the Linux kernel does not properly check file capabilities against user namespaces. A local user can gain root privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Linux Kernel affected ? fixed ?
- vendor:canonical ubuntu linux affected < 18.04 fixed 18.04
- vendor:canonical ubuntu linux affected >= 18.04.1, < 20.04 fixed 20.04
- vendor:canonical ubuntu linux affected < 20.10 fixed 20.10

## Fix

Apply the kernel update from your Linux distribution vendor; CISA says to apply updates per vendor instructions.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3493
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-3493

## From the sources

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_