{"id":"CVE-2021-3493","published":"2021-04-17T05:15:14Z","modified":"2026-06-17T04:05:12Z","title":"Linux Kernel Privilege Escalation Vulnerability","vendor":"Linux","product":"Kernel","tier":"core","eol":null,"description":{"text":"The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.","provenance":"source","from":"NVD"},"summary":{"text":"The Linux kernel's overlayfs implementation fails to properly validate file capability settings on files in an underlying filesystem with respect to user namespaces, and this flaw combines with an Ubuntu kernel patch that permits unprivileged overlay mounts. An attacker with local access and low privileges, who can create unprivileged user namespaces, can exploit this to gain elevated privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:53Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.49166,"percentile":0.98882,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-10-20","dueDate":"2022-11-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52; https://nvd.nist.gov/vuln/detail/CVE-2021-3493","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-10-20","exploitedFirstSeen":"2022-10-20","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-10-20"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"},{"id":"CWE-270","name":"Privilege Context Switching Error"},{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html","tags":["Press/Media Coverage","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4917-1","tags":["Vendor Advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2021/04/16/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html","tags":["Press/Media Coverage","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4917-1","tags":["Vendor Advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2021/04/16/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3493","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local privilege escalation via overlayfs capabilities","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"an attacker could use this to gain elevated privileges","start":320,"end":374}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: abuses setuid/capability elevation mechanisms","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Due to the combination of unprivileged user namespaces along with a patch","start":179,"end":252}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-26815","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26815","exploited":true,"exploitedSince":"2022-10-20","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":15,"skipped":6,"earliest":"2021-04-19","earliestUrl":"https://github.com/briskets/CVE-2021-3493","repos":[{"name":"briskets/CVE-2021-3493","url":"https://github.com/briskets/CVE-2021-3493","stars":445,"created":"2021-04-19"},{"name":"inspiringz/CVE-2021-3493","url":"https://github.com/inspiringz/CVE-2021-3493","stars":42,"created":"2021-07-07"},{"name":"oneoy/CVE-2021-3493","url":"https://github.com/oneoy/CVE-2021-3493","stars":3,"created":"2021-04-22"},{"name":"cerodah/overlayFS-CVE-2021-3493","url":"https://github.com/cerodah/overlayFS-CVE-2021-3493","stars":2,"created":"2021-09-12"},{"name":"puckiestyle/CVE-2021-3493","url":"https://github.com/puckiestyle/CVE-2021-3493","stars":2,"created":"2021-10-02"}]},"metasploit":[{"name":"2021 Ubuntu Overlayfs LPE","module":"exploit/linux/local/cve_2021_3493_overlayfs","type":"exploit","disclosureDate":"2021-04-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_3493_overlayfs.rb"}],"first":{"date":"2021-04-12","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_3493_overlayfs.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html","http://packetstormsecurity.com/files/165151/Ubuntu-Overlayfs-Local-Privilege-Escalation.html","http://packetstormsecurity.com/files/162866/Ubuntu-OverlayFS-Local-Privilege-Escalation.html"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1548"],"provenance":"ai"}],"timeline":[{"date":"2021-04-12","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-04-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2021_3493_overlayfs.rb","provenance":"source"},{"date":"2021-04-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3493","provenance":"source"},{"date":"2022-10-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-10-20","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-10-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26815","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":551},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1472 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.78,"detail":"percentile 0.9888"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 NVD exploit link; 15 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}