Hazard

Is CVE-2023-0386 being exploited?

Confirmed exploited in the wild

CISA has evidence of active exploitation. This is not theoretical risk — someone has already used it against someone.

Linux Kernel Improper Ownership Management Vulnerability

Linux · Kernel

CVSS 7.8 EPSS 8% no public exploit indexed Fix deadline passed 8 July 2025

What it is

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Why we say that

  • CISA's federal remediation deadline (2025-07-08) has passed
  • Listed in the CISA Known Exploited Vulnerabilities catalogue

Every line above comes from a named public source. Where the evidence is thin, we say so rather than inventing confidence — see methodology.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What it costs when this goes wrong

This is where UK enforcement meets the vulnerability record. Where an unfixed vulnerability leads to a breach, the ICO treats it as a security failure under UK GDPR. Recent cases:

All UK cases caused by unpatched software →