Risk Letters

Exploited vulnerability

CVE-2023-0386

TLP:CLEAR

Linux Kernel Improper Ownership Management Vulnerability

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Facts

  • Vendor: Linux
  • Product: Kernel
  • CVSS: 7.8
  • EPSS (probability of exploitation within 30 days): 7.9 %
  • On CISA's Known Exploited Vulnerabilities list since: 17 June 2025
  • First known exploitation: 17 June 2025
  • CISA's deadline for US federal agencies: 8 July 2025
  • Weakness: CWE-282
  • First seen by Risk Letters: 17 June 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD