CVE-2021-3493

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.

• Bump kernel ABI to 30: ship the ELS kernel as 4.19.0-30-*, distinct from the prior 4.19.0-29.
• CVE-2021-3493
  • vfs: move cap_convert_nscap() call into vfs_setxattr() {CVE-2021-3493}
  • ecryptfs: fix uid translation for setxattr on security.capability {CVE-2021-3493}
• CVE-2025-23142
  • sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
• CVE-2025-38352
  • posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-52955
  • libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
• CVE-2026-53091
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2026-63814
  • f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}
• CVE-2026-63815
  • f2fs: bound i_inline_xattr_size for non-inline-xattr inodes {CVE-2026-63815}
• CVE-2026-63922
  • ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• CVE-2026-63962
  • usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64009
  • xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• CVE-2026-64011
  • nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}
• CVE-2026-64372
  • cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• CVE-2026-64378
  • writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
  • writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• CVE-2026-64381
  • smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381}
• CVE-2026-64471
  • Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• CVE-2026-64483
  • ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• CVE-2026-64504
  • iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504}
• CVE-2026-64505
  • usb: gadget: function: rndis: add length check for header {CVE-2026-64505}
• CVE-2026-64541
  • net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket {CVE-2026-64541}
• CVE-2026-64543
  • tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543}
• CVE-2026-64546
  • drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• CVE-2026-64563
  • rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• CVE-2026-64564
  • sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• CVE-2026-72389
  • bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• CVE-2026-74444
  • drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• CVE-2026-74454
  • drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size {CVE-2026-74454}
• CVE-2026-74469
  • sctp: prevent peer transport count overflow {CVE-2026-74469}
• CVE-2026-74479
  • net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• CVE-2026-74498
  • ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• CVE-2026-74499
  • ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() …

It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges.(CVE-2021-3493)

Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux kernel did not properly validate computation of branch displacements in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2021-29154)

It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. (CVE-2021-3493)

Vincent Dehors discovered that the shiftfs file system in the Ubuntu Linux kernel did not properly handle faults in copy_from_user() when passing through ioctls to an underlying file system. A local attacker could use this to cause a denial of service (memory exhaustion) or execute arbitrary code. (CVE-2021-3492)

It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. (CVE-2021-3493)

Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux kernel did not properly validate computation of branch displacements in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)

It was discovered that the overlayfs implementation in the Linux kernel did not properly validate the application of file system capabilities with respect to user namespaces. A local attacker could use this to gain elevated privileges. (CVE-2021-3493)

Vincent Dehors discovered that the shiftfs file system in the Ubuntu Linux kernel did not properly handle faults in copy_from_user() when passing through ioctls to an underlying file system. A local attacker could use this to cause a denial of service (memory exhaustion) or execute arbitrary code. (CVE-2021-3492)

Piotr Krysiuk discovered that the BPF JIT compiler for x86 in the Linux kernel did not properly validate computation of branch displacements in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-29154)