Search/CVE-2022-0847
● CVE — High

CVE-2022-0847

Vendorfedoraproject, linux, netapp, redhat, ovirtProductfedora, linux kernel, h300e firmware, h300s firmware, h500e firmware, h500s firmware, h700e firmware, h700s firmware, enterprise linux, enterprise linux eus, enterprise linux for ibm z systems, enterprise linux for ibm z systems eus, enterprise linux for power little endian, enterprise linux for power little endian eus, enterprise linux server aus, enterprise linux server for power little endian update services for sap solutions, enterprise linux server tus, enterprise linux for real time, enterprise linux for real time for nfv, enterprise linux server update services for sap solutions, virtualization host, ovirt-engine, enterprise linux for real time for nfv tus, enterprise linux for real time tus, codeready linux builderDiscoveredMar 10, 2022UpdatedNov 6, 2025

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

View graph Watch Export
CVSS v3.1
7.8 HIGH
EPSS
92.8%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
22
sources referencing this CVE
Related IOCs
5
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 25, 2026
▲ 4.19pp
88.6% → 92.8% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Connections
52 relationships
fedora
source
linux kernel
source
h300e firmware
source
h300s firmware
source
h500e firmware
source
h500s firmware
source
h700e firmware
source
h700s firmware
source
enterprise linux
source
enterprise linux eus
source
enterprise linux for ibm z systems
source
enterprise linux for ibm z systems eus
source
enterprise linux for power little endian
source
enterprise linux for power little endian eus
source
enterprise linux server aus
source
enterprise linux server for power little endian update services for sap solutions
source
enterprise linux server tus
source
enterprise linux for real time
source
enterprise linux for real time for nfv
source
enterprise linux server update services for sap solutions
source
virtualization host
source
ovirt-engine
source
enterprise linux for real time for nfv tus
source
enterprise linux for real time tus
source
codeready linux builder
source
Timeline
disclosure → media coverage
Mar 10, 2022
Disclosure — published as a CVE record. · last revised by NVD Nov 6, 2025
Aug 27, 2025
securelist.com reports: Exploits and vulnerabilities in Q2 2025
Dec 3, 2025
securelist.com reports: Exploits and vulnerabilities in Q3 2025
Mar 6, 2026
securelist.com reports: Exploits and vulnerabilities in Q4 2025
Mar 30, 2026
helpnetsecurity.com reports: Breaking out: Can AI agents escape their sandboxes?
Apr 30, 2026
thehackernews.com reports: New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions
Apr 30, 2026
securityweek.com reports: ‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover
Apr 30, 2026
bleepingcomputer.com reports: New Linux ‘Copy Fail’ flaw gives hackers root on major distros
May 5, 2026
unit42.paloaltonetworks.com reports: Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
May 7, 2026
securelist.com reports: Exploits and vulnerabilities in Q1 2026
May 8, 2026
thehackernews.com reports: Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
May 8, 2026
bleepingcomputer.com reports: New Linux 'Dirty Frag' zero-day gives root on all major distros
May 8, 2026
isc.sans.edu reports: Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
May 8, 2026
acn.gov.it reports: Dirty Frag: rilevata PoC per l'elevazione di privilegi in Linux - CVE-2026-43284
May 11, 2026
securityweek.com reports: New ‘Dirty Frag’ Linux Vulnerability Possibly Exploited in Attacks
May 11, 2026
darkreading.com reports: 'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros
Jun 26, 2026
thehackernews.com reports: New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
Jun 29, 2026
securityweek.com reports: ‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access
Jul 3, 2026
thehackernews.com reports: New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
Jul 6, 2026
thehackernews.com reports: 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
Aug 26, 2026
securelist.com reports: Exploits and vulnerabilities in Q2 2026
Sep 21, 2026
bleepingcomputer.com reports: CISA alerts of active exploitation of three Linux kernel flaws
Sep 22, 2026
bleepingcomputer.com reports: Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
Public PoC (10)
github.com/bbaranoff/CVE-2022-0847github.com/xndpxs/CVE-2022-0847github.com/r1is/CVE-2022-0847github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploitgithub.com/crowsec-edtech/Dirty-Pipegithub.com/lucksec/CVE-2022-0847github.com/si1ent-le/CVE-2022-0847github.com/bohr777/cve-2022-0847dirtypipe-exploitgithub.com/ZZ-SOCMAP/CVE-2022-0847github.com/cspshivam/CVE-2022-0847-dirty-pipe-exploit
Unverified third-party code — review before executing.