Database/Kernel, userspace & hypervisor
Linux kernel (OverlayFS/FUSE): OverlayFS copies setuid files from a nosuid FUSE mount
Impact
OverlayFS copies setuid files from a nosuid FUSE mount - unprivileged local user to root, a live container-escape chain [KEV]
Who can reach it
Any tenant process in a container with a user namespace
What to do
Livepatchable; otherwise drain + reboot. Compensating control: disallow unprivileged FUSE mounts
Fleet impact
How widespread
Universal - kernels 5.11-6.1.8, and OverlayFS *is* the container storage driver on every containerized GPU host
Cost to remediate
node-reboot - kernel upgrade; no meaningful runtime mitigation since disabling OverlayFS breaks container storage
Why it hits the whole fleet
Copying a setuid binary across a nosuid OverlayFS mount preserves capabilities, giving any regular user root; inside a container it gives container-root, which then chains into the cgroup/procfs escapes above on a shared GPU host
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.