Local privilege escalation via unchecked metadata copy

Incorrect authorization in Canonical Ubuntu Kernel OverlayFS allows local users to gain root privileges through a crafted overlay mount. The ovl_copy_up_meta_inode_data path calls ovl_do_setxattr without the required permission check, copying privileged file capabilities into the upper layer. A local user namespace with unprivileged namespace creation and an OverlayFS mount using metacopy=on makes the path reachable; the resulting executable runs with root-equivalent capabilities.