---
id: "CVE-2023-0386"
kind: "vulnerability"
aliases: ["CVE-2023-0386"]
title: "A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "debian linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "netapp h300s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h500s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h700s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h410s firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp h410c firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 18.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 20.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 22.04", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.15.91"], "affected": ">= 5.11, < 5.15.91", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.1.9"], "affected": ">= 5.16, < 6.1.9", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": [], "affected": "= 6.2", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "kubernetes", "linux", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2023-03-22T21:15:18+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:50+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0386", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with…

A flaw in the Linux kernel's OverlayFS lets a local user copy a file with capabilities from a nosuid mount into another mount and gain elevated privileges. An attacker with a local shell gets root-level privileges on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:debian linux affected = 10.0 fixed ?
- vendor:netapp h300s firmware affected ? fixed ?
- vendor:netapp h500s firmware affected ? fixed ?
- vendor:netapp h700s firmware affected ? fixed ?
- vendor:netapp h410s firmware affected ? fixed ?
- vendor:netapp h410c firmware affected ? fixed ?
- vendor:canonical ubuntu linux affected = 18.04 fixed ?
- vendor:canonical ubuntu linux affected = 20.04 fixed ?
- vendor:canonical ubuntu linux affected = 22.04 fixed ?
- vendor:linux kernel affected >= 5.11, < 5.15.91 fixed 5.15.91
- vendor:linux kernel affected >= 5.16, < 6.1.9 fixed 6.1.9
- vendor:linux kernel affected = 6.2 fixed ?
- vendor:Linux Kernel affected ? fixed ?

## Fix

Update to a patched Linux kernel from your distribution; the sources do not name the fixed versions.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-0386
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-0386

## From the sources

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_