CVE-2021-3493
Linux Kernel Privilege Escalation Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52; https://nvd.nist.gov/vuln/detail/CVE-2021-3493
Description
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitation Context
as of October 17, 2026- CISA added CVE-2021-3493 to the KEV catalog 551 days after its CVE record was published.
- It is one of 31 Linux Kernel entries in the CISA KEV catalog, and one of 8 added in 2022.
- Its current EPSS score (49.2%) is higher than that of 50% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Ubuntu | Ubuntu linux kernel | 5.8 kernel to <5.8.0-50.56 5.4 kernel to <5.4.0-72.80 4.15 kernel to <4.15.0-142.146 4.4 kernel to <4.4.0-209.241 |
References
6 Links- https://ubuntu.com/security/notices/USN-4917-1
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52
- https://www.openwall.com/lists/oss-security/2021/04/16/1
- http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html
- http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html
Record Details
More from Linux Kernel
Linux Kernel Privilege Escalation Vulnerability
Linux Kernel Race Condition Vulnerability
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
Linux Kernel Improper Privilege Management Vulnerability
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.