CVE-2022-0847: Linux kernel pipe buffer flaw allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 7.8, CISA KEV listing, public exploits and very high EPSS make this a high-priority local privilege escalation flaw.

What it is

The flags member of the new pipe buffer structure was not properly initialized in copy_page_to_iter_pipe and push_pipe, so it could hold stale values. An unprivileged local user can exploit this to write to page cache pages backing read-only files, overwriting data and escalating privileges. The flaw is in the Linux kernel and affects multiple distributions and products built on it.

Impact

An attacker with a local unprivileged account gains the ability to write to read-only file pages in the page cache, which can be used to modify protected files and escalate to root. This breaks file integrity and gives full control of the host.

Attack surface

Reached locally by any unprivileged user on a vulnerable Linux kernel; no authentication beyond a local session and no user interaction are required. The CVSS vector AV:L/PR:L/UI:N confirms local, low-privilege access.

Exploitation

CVE-2022-0847 is in CISA KEV (added 2022-04-25) and public exploit code is referenced, with an EPSS 30-day probability of 0.897. No ransomware campaign use is documented.

What to do

• Apply the Linux kernel update from your distribution vendor (Red Hat, Fedora, SUSE, Siemens, SonicWall, NetApp and others have advisories) as the primary fix.
• If patching cannot be done immediately, restrict local shell access and untrusted local users on affected hosts.
• Monitor vendor advisories for the specific kernel packages and versions in use and track the KEV due date of 2022-05-16.
• Reboot after kernel updates so the fixed kernel is running.
• Consider hardening against local privilege escalation by limiting SUID binaries and local accounts where feasible.

Detection

• Monitor for unexpected writes to read-only files or page cache anomalies on Linux hosts.
• Watch for execution of known Dirty Pipe exploit binaries or scripts from local user directories.
• Alert on local privilege escalation attempts and unusual SUID binary behavior.
• Audit kernel versions against vendor fixed releases and flag unpatched systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.