Actively exploited · Published Mar 22, 2023 · Assigned by redhat
CVE-2023-0386
High 7.8 Exploited
In plain English
A high-severity security flaw in Kernel. Attackers are actively exploiting it in the wild (listed by CISA on June 17, 2025). The chance it is exploited in the next 30 days is estimated at 7.9% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)7.9%top 5.3% of all CVEs
Exploited in the wildYesCISA KEV since Jun 17, 2025
Attack tooling2Metasploit, Public PoC
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jul 8, 2025.
Official description
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | bpftool | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-abi-stablelists | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-abi-stablelists | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-core | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-core | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-cross-headers | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-cross-headers | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-debug | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-debug | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-debug-core | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-debug-core | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-debug-devel | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-debug-devel | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:9 | kernel-debug-devel-matched | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-debug-modules | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-debug-modules | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-debug-modules-extra | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-debug-modules-extra | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-devel | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-devel | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:9 | kernel-devel-matched | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-doc | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-doc | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-modules | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-modules | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-modules-extra | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-modules-extra | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-rt | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-core | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-core | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-debug | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-debug | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-debug-core | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-debug-core | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-debug-devel | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-debug-devel | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-debug-kvm | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-debug-kvm | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-debug-modules | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-debug-modules | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-devel | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-devel | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-kvm | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-kvm | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-modules | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-modules | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-rt-modules-extra | 4.18.0-425.19.2.rt7.230.el8_7 | ALSA-2023:1584 |
| AlmaLinux:9 | kernel-rt-modules-extra | 5.14.0-162.23.1.rt21.186.el9_1 | ALSA-2023:1691 |
| AlmaLinux:8 | kernel-tools | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-tools | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-tools-libs | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-tools-libs | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-tools-libs-devel | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-zfcpdump | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-zfcpdump | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-zfcpdump-core | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-zfcpdump-core | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | perf | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | perf | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| AlmaLinux:8 | python3-perf | 4.18.0-425.19.2.el8_7 | ALSA-2023:1566 |
| AlmaLinux:9 | python3-perf | 5.14.0-162.23.1.el9_1 | ALSA-2023:1703 |
| Debian:12 | linux | 6.1.11-1 | DEBIAN-CVE-2023-0386 |
| Debian:13 | linux | 6.1.11-1 | DEBIAN-CVE-2023-0386 |
| Debian:14 | linux | 6.1.11-1 | DEBIAN-CVE-2023-0386 |
| Rocky Linux:8 | kernel | 0:4.18.0-425.19.2.el8_7 | RLSA-2023:1566 |
| Rocky Linux:8 | kernel | 0:4.18.0-425.19.2.el8_7.cloud | RXSA-2023:1566 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-425.19.2.rt7.230.el8_7 | RLSA-2023:1584 |
| Ubuntu:22.04:LTS | linux | 5.15.0-70.77 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux | 5.15.0-70.77 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1034.38 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1034.38 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1036.43 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1036.43 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1036.43.1 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1036.43.1 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1032.40 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1032.40 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1031.36 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1031.36 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1018.23 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1018.23 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 5.19.0-41.42~22.04.1 | USN-6043-1 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 5.19.0-41.42~22.04.1 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1028.31 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1028.31 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1028.33 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1028.33 | USN-6057-1 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1031.36 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1031.36 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-70.77 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-70.77 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1023.23 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 5.17.0-1031.32 | USN-6071-1 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | 5.17.0-1031.32 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 6.0.0-1015.15 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | 6.0.0-1015.15 | USN-6072-1 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1008.8 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1033.39 | USN-6025-1 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1033.39 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1027.29 | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1027.29 | USN-6025-1 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2023-0386 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2023-0386 |
Affected products (as reported)
Weakness: CWE-282 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a
- https://security.netapp.com/advisory/ntap-20230420-0004/
- DSA-5402 vendor-advisory
- [debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update mailing-list
- http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
- [debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update mailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0386 government-resource