CVE-2021-3493
Linux Kernel Privilege Escalation Vulnerability
Published Apr 16, 2021 · updated Jun 16, 2026 · canonical ubuntu linux
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Timeline
Detection, updates, and resolution for this record.
Apr 16, 2021 · Catalog
Detected
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Oct 20, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Required action
Apply updates per vendor instructions.
CISA due date Nov 10, 2022
Affected
- cpe canonical/ubuntu linuxversion unspecified
- vendor Linux Kernelversion unspecified
Sources
- CISA KEVCVE-2021-3493
The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.
cisa.gov - CVE.orgCVE-2021-3493
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-3493
30-day exploitation probability 49.2%
first.org - Metasploit Modulesexploit_linux/local/cve_2021_3493_overlayfs
Public module reference (great). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2021-3493
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kerne
nvd.nist.gov