CVE-2023-2640: High severity Canonical Ubuntu Linux vulnerability
Last updated 23 May 2026
Other sources
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs. xattrs", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Set kernel.unprivileged_userns_clone=0 to disable unprivileged user namespace creation; apply temporarily with `sudo sysctl -w kernel.unprivileged_userns_clone=0` and persist across reboots by writing `kernel.unprivileged_userns_clone=0` to `/etc/sysctl.d/99-disable-unpriv-userns.conf`.
Ubuntu kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is CVE-2023-2640?
CVE-2023-2640 is a vulnerability in Ubuntu kernels that allows an unprivileged user to set privileged extended attributes on mounted files without appropriate security checks.
What is the severity of CVE-2023-2640?
The severity of CVE-2023-2640 is high with a CVSS score of 7.8.
Which software is affected by CVE-2023-2640?
Ubuntu Linux 23.04, ubuntu/linux 6.2.0-26.26, ubuntu/linux-hwe-5.19 5.19.0-50.50, and other Ubuntu packages are affected by CVE-2023-2640.
How can I fix CVE-2023-2640?
To fix CVE-2023-2640, update your Ubuntu kernel and packages to the recommended versions mentioned in the Ubuntu Security Notice (USN-6250-1).
Where can I find more information about CVE-2023-2640?
You can find more information about CVE-2023-2640 on the MITRE CVE website, Ubuntu Security Notice (USN-6250-1), and the Ubuntu kernel-team mailing list.