CVE-2016-5195: Linux Kernel Dirty COW Race Condition Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed in-the-wild exploitation, has a very high EPSS score, and grants root on unpatched Linux hosts.

What it is

A race condition in the Linux kernel's mm/gup.c mishandles copy-on-write, letting a local user write to read-only memory mappings. This breaks the read-only guarantee of files such as /etc/passwd and enables privilege escalation. It affects Linux kernel 2.x through 4.x before 4.8.3 and was exploited in the wild in October 2016.

Impact

An attacker with local access gains write access to otherwise read-only files and can escalate to root. That yields full control of the affected host.

Attack surface

Reached locally by any user who can run code on the system; the CVSS vector is AV:L/PR:L/UI:N, so low privileges are required and no user interaction is needed. No network vector is described.

Exploitation

It is listed in CISA KEV (added 2022-03-03) and the description states it was exploited in the wild in October 2016. EPSS is 0.83524 (99.667th percentile), indicating high predicted exploitation activity.

What to do

• Patch the Linux kernel to 4.8.3 or later, or apply the vendor kernel update for your distribution.
• Apply the referenced kernel commit (19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619) where backporting is required.
• Update affected vendor products (Ubuntu, RHEL, Debian, Fedora, PAN-OS, NetApp) per their advisories.
• Restrict local shell and code execution to trusted users to reduce exposure until patching completes.
• Verify kernel versions across servers, containers and appliances, since the flaw spans kernel 2.x through 4.x.

Detection

• Monitor for unexpected writes to read-only files such as /etc/passwd, /etc/shadow and SUID binaries.
• Alert on privilege escalation or new root processes spawned by unprivileged users.
• Track kernel version inventory and flag hosts still running kernels before 4.8.3.
• Watch for known Dirty COW exploit binaries or compilation activity on hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.