Search/CVE-2016-5195
● CVE — High

CVE-2016-5195

Vendordebian, fedoraproject, linux, canonical, redhatProductdebian linux, fedora, linux kernel, ubuntu linux, enterprise linux, enterprise linux eus, oncommand balance, oncommand performance manager, pan-os, cloud backup, enterprise linux aus, solidfire, hci storage nodes, snapprotect, ontap select deploy administration utility, enterprise linux tus, oncommand unified manager for clustered data ontap, enterprise linux long lifeDiscoveredNov 10, 2016UpdatedApr 21, 2026

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

View graph Watch Export
CVSS v3.1
7 HIGH
EPSS
83.5%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
12
sources referencing this CVE
Related IOCs
26
seen in the same coverage
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Connections
33 relationships
Timeline
disclosure → media coverage
Nov 10, 2016
Disclosure — published as a CVE record. · last revised by NVD Apr 21, 2026
Aug 22, 2025
thehackernews.com reports: Chinese Hackers Murky, Genesis, and Glacial Panda Escalate Cloud and Telecom Espionage
Sep 24, 2025
securityweek.com reports: GeoServer Flaw Exploited in US Federal Agency Hack
Mar 30, 2026
helpnetsecurity.com reports: Breaking out: Can AI agents escape their sandboxes?
Apr 30, 2026
securityweek.com reports: ‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover
May 5, 2026
unit42.paloaltonetworks.com reports: Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
May 8, 2026
isc.sans.edu reports: Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
Jul 3, 2026
thehackernews.com reports: New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
Jul 23, 2026
thehackernews.com reports: Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
Jul 23, 2026
bleepingcomputer.com reports: New RefluXFS Linux flaw lets attackers gain root privileges
Aug 11, 2026
unit42.paloaltonetworks.com reports: Kimwolf v7: An Evolution of the Kimwolf Botnet
Aug 11, 2026
thehackernews.com reports: Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
Sep 15, 2026
securityweek.com reports: Thai Broadband Provider Hacked via Fortinet Vulnerability
Public PoC (10)
github.com/ASRTeam/CVE-2016-5195github.com/timwr/CVE-2016-5195github.com/xlucas/dirtycow.crgithub.com/istenrot/centos-dirty-cow-ansiblegithub.com/pgporada/ansible-role-cvegithub.com/sideeffect42/DirtyCOWTestergithub.com/scumjr/dirtycow-vdsogithub.com/gbonacini/CVE-2016-5195github.com/DavidBuchanan314/cowrootgithub.com/aishee/scan-dirtycow
Unverified third-party code — review before executing.