Summary
Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
- Vendor
- Linux
- Product
- Kernel
- Added to KEV
- Jun 17, 2025
- Remediation due
- Jul 8, 2025 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-282
- EPSS
- 7.9% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References