Vulnerability detail

Enriched intelligence for a single CVE

7.8

CVSS
High

CVE-2023-0386

PUBLISHED

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux...

1 day faster than CISA KEV

Exploited in the wild PoC available Low complexity No user interaction

Vendor: Linux
Product: Linux kernel
Published: Mar 22, 2023
EPSS: 48.5% · 98% pctl

Automate this intelligence with the Pro API

Everything on this page — CVSS, EPSS, exploit status, PoCs, scanner integrations, mentions, tags, and immediate honeypot data — is available programmatically for VM, SOC, and CTI workflows.

Learn about Pro

Description

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

linux cisa

Weaknesses (CWE)

CWE-282

Improper Ownership Management

CVSS scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2026-06-01 13:30:39 UTC · CISA

Proof of concept available

Recorded 2023-05-05 03:02:13 UTC · GitHub

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CVE First	2026-06-01 10:33 UTC
CISA	2026-06-02 14:07 UTC
Daily CyberSecurity	2026-06-10 02:20 UTC

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb	Apr 28, 2025

Recent mentions

CISA Expands Active Exploit Catalog with Cisco, Arista, and Chromium Flaws

Daily CyberSecurity · Jun 10, 2026

Federal Registry Alerts Enterprise Teams to Real-World Infiltration Risks The Cybersecurity and Infrastructure Security Agency updated its primary The post CISA Expands Active Exploit Catalog with Cisco, Arista, and Chromium Flaws appeared first on Daily CyberSecurity. Related posts: Linux Kernel Flaw (CVE-2023-0386) Actively Exploited for Root Privilege Escalation, PoC Available CVE-2025-23171 & CVE-2025-23172: Versa Director Bugs Open Doors to Webshell Uploads and Command Execution CISA KEV Alert: EOL D-Link and Array Networks Command Injection Under Active Attack