CVE-2021-3493

VendorcanonicalProductubuntu linuxDiscoveredApr 17, 2021UpdatedOct 28, 2025

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

View graph Watch Export

CVSS v3.1

8.8 HIGH

EPSS

49.2%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorLOCAL

Attack ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Connections

2 relationships

ubuntu linux

source

Timeline

disclosure → media coverage

Apr 17, 2021

Disclosure — published as a CVE record. · last revised by NVD Oct 28, 2025

Public PoC (10)

github.com/briskets/CVE-2021-3493 github.com/oneoy/CVE-2021-3493 github.com/Abdennour-py/CVE-2021-3493 github.com/inspiringz/CVE-2021-3493 github.com/derek-turing/CVE-2021-3493 github.com/cerodah/overlayFS-CVE-2021-3493 github.com/puckiestyle/CVE-2021-3493 github.com/fei9747/CVE-2021-3493 github.com/pmihsan/OverlayFS-CVE-2021-3493 github.com/ptkhai15/OverlayFS---CVE-2021-3493

Unverified third-party code — review before executing.