A public proof of concept turns CVE-2023-0386 into a local root shell on Ubuntu 22.04.
The bug sits in the Linux kernel’s OverlayFS: when a file with capabilities is copied up from a nosuid mount into another mount, the uid mapping goes wrong and an unprivileged user ends up executing a setuid file with those capabilities.
The exploit serves that file from its own FUSE filesystem; run fuse in one terminal, exp in the other, and you are root.
Affected are kernels 5.11 up to 5.15.90 and 5.16 up to 6.1.8; 5.15.91 and 6.1.9 carry the fix.
Those kernels shipped in February, so any box still unpatched now comes with a ready-made exploit attached.
