diff --git a/patches.suse/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch b/patches.suse/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch
new file mode 100644
index 0000000..19ac837
--- /dev/null
+++ b/patches.suse/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch
@@ -0,0 +1,52 @@
+From 984534ac10f71d0b4c2541b2b1fa231d245d668d Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Tue, 24 Jan 2023 16:41:18 +0100
+Subject: [PATCH] ovl: fail on invalid uid/gid mapping at copy up
+Git-commit: 4f11ada10d0ad3fd53e2bd67806351de63a4f9c3
+Patch-mainline: v6.2-rc6
+References: CVE-2023-0386 bsc#1209615
+
+If st_uid/st_gid doesn't have a mapping in the mounter's user_ns, then
+copy-up should fail, just like it would fail if the mounter task was doing
+the copy using "cp -a".
+
+There's a corner case where the "cp -a" would succeed but copy up fail: if
+there's a mapping of the invalid uid/gid (65534 by default) in the user
+namespace.  This is because stat(2) will return this value if the mapping
+doesn't exist in the current user_ns and "cp -a" will in turn be able to
+create a file with this uid/gid.
+
+This behavior would be inconsistent with POSIX ACL's, which return -1 for
+invalid uid/gid which result in a failed copy.
+
+For consistency and simplicity fail the copy of the st_uid/st_gid are
+invalid.
+
+Fixes: 459c7c565ac3 ("ovl: unprivieged mounts")
+Cc: <stable@vger.kernel.org> # v5.11
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Reviewed-by: Seth Forshee <sforshee@kernel.org>
+Acked-by: David Disseldorp <ddiss@suse.de>
+---
+ fs/overlayfs/copy_up.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 2846b943e80c1..95b2173ab9bca 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -886,6 +886,10 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
+ 	if (err)
+ 		return err;
+ 
++	if (!kuid_has_mapping(current_user_ns(), ctx.stat.uid) ||
++	    !kgid_has_mapping(current_user_ns(), ctx.stat.gid))
++		return -EOVERFLOW;
++
+ 	ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags);
+ 
+ 	if (parent) {
+-- 
+2.40.0
+
diff --git a/series.conf b/series.conf
index 1ec9a48..263e2b4 100644
--- a/series.conf
+++ b/series.conf
@@ -36899,6 +36899,7 @@
 	patches.suse/VMCI-Use-threaded-irqs-instead-of-tasklets.patch
 	patches.suse/module-Don-t-wait-for-GOING-modules.patch
 	patches.suse/netlink-prevent-potential-spectre-v1-gadgets.patch
+	patches.suse/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch
 	patches.suse/tracing-Fix-poll-and-select-do-not-work-on-per_cpu-trace_pipe-and-trace_pipe_raw.patch
 	patches.suse/rds-rds_rm_zerocopy_callback-use-list_first_entry.patch
 	patches.suse/Fix-page-corruption-caused-by-racy-check-in-__free_pages.patch