Skip to content
OpenAdvisories
High · 7.0 Known exploited Public exploit CVE-2016-5195 EUVD-2016-6146GHSA-j68w-7qm9-fjqq

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect h…

Published Nov 10, 2016 · Updated Nov 4, 2025 · Assigned by Chrome

Description

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 4.7.8-1 —
Debian 13 linux 4.7.8-1 —
Debian 12 linux 4.7.8-1 —
Debian 8 linux 3.16.36-1+deb8u2 DSA-3696-1
Debian 7 linux 3.2.82-1 DLA-670-1
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux 4.4.0-45.66 USN-3106-1
Ubuntu 16.04 LTS linux-raspi2 4.4.0-1029.36 USN-3106-3
Ubuntu 16.04 LTS linux-snapdragon 4.4.0-1032.36 USN-3106-4
Ubuntu 14.04 LTS linux 3.13.0-100.147 USN-3105-1
Ubuntu 14.04 LTS linux-lts-vivid 3.19.0-73.81~14.04.1 —
Ubuntu 14.04 LTS linux-lts-xenial 4.4.0-45.66~14.04.1 USN-3106-2
ReleasePackageFixed inAdvisory
RHEL 7 kernel-aarch64 +1 4.5.0-15.2.1.el7 RHSA-2017:0372
RHEL 7 kernel-rt +10 3.10.0-327.36.3.rt56.238.el7 RHSA-2016:2110
RHEL 7 perf +18 3.10.0-327.36.3.el7 RHSA-2017:0372, RHSA-2016:2098
RHEL 6 perf +16 2.6.32-642.6.2.el6 RHSA-2016:2105
RHEL 5 kernel +12 2.6.18-416.el5 RHSA-2016:2124
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Mission Critical 6 perf +9 2.6.32-220.68.1.el6 RHSA-2016:2132
Red Hat Rhel Mission Critical 5 kernel +10 2.6.18-238.57.1.el5 RHSA-2016:2127
RHEL 7.1 EUS kernel-kdump +4 3.10.0-229.42.2.el7 RHSA-2016:2118
RHEL 7.1 EUS perf +13 3.10.0-229.42.2.ael7b RHSA-2016:2118
RHEL 6.7 EUS perf +16 2.6.32-573.35.2.el6 RHSA-2016:2106
RHEL 6.6 EUS perf +16 2.6.32-504.54.1.el6 RHSA-2016:2128
RHEL 6.5 TUS perf +10 2.6.32-431.75.1.el6 RHSA-2016:2120
RHEL 6.5 AUS perf +10 2.6.32-431.75.1.el6 RHSA-2016:2120
RHEL 6.4 AUS perf +9 2.6.32-358.75.1.el6 RHSA-2016:2133
RHEL 5.9 AUS kernel +10 2.6.18-348.32.1.el5 RHSA-2016:2126
Red Hat MRG 2 kernel-rt +10 1:3.10.0-327.rt56.198.el6rt RHSA-2016:2107
ReleasePackageFixed inAdvisory
SLES 12 SP1 kernel-docs 3.12.62-60.64.8.5 SUSE-SU-2016:2592-1
SLES 12 SP1 kernel-obs-build 3.12.62-60.64.8.3 SUSE-SU-2016:2592-1
SLES 12 SP1 kernel-xen +3 3.12.62-60.64.8.2 SUSE-SU-2016:2592-1
SLES 12 kernel-ec2 +4 3.12.60-52.57.1 SUSE-SU-2016:2593-1, SUSE-SU-2016:2592-1
SLES 12 kgraft-patch-SLE12_Update_10 6-2.1 SUSE-SU-2016:2632-1
SLES 12 kgraft-patch-SLE12_Update_11 5-2.1 SUSE-SU-2016:2633-1
SLES 12 kgraft-patch-SLE12_Update_12 +3 3-2.1 SUSE-SU-2016:2659-1, SUSE-SU-2016:2658-1, SUSE-SU-2016:2657-1
SLES 12 kgraft-patch-SLE12_Update_16 1-2.1 SUSE-SU-2016:2593-1
SLES 12 kgraft-patch-SLE12_Update_9 6-5.1 SUSE-SU-2016:2636-1
SLES 11 SP4 kernel-docs 3.0.101-84.2 SUSE-SU-2016:2585-1
SLES 11 SP4 kernel-ec2 +7 3.0.101-84.1 SUSE-SU-2016:2585-1
SLES 11 SP3 kernel-ec2 +7 3.0.101-0.47.90.1 SUSE-SU-2016:2614-1
SLES 11 SP2 kernel-ec2 +6 3.0.101-0.7.44.1 SUSE-SU-2016:2596-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP1 kernel-xen +3 3.12.62-60.64.8.2 SUSE-SU-2016:2592-1
SLES for SAP 12 kernel-xen +3 3.12.60-52.57.1 SUSE-SU-2016:2593-1
SLES for SAP 12 kgraft-patch-SLE12_Update_10 6-2.1 SUSE-SU-2016:2632-1
SLES for SAP 12 kgraft-patch-SLE12_Update_11 5-2.1 SUSE-SU-2016:2633-1
SLES for SAP 12 kgraft-patch-SLE12_Update_12 +3 3-2.1 SUSE-SU-2016:2659-1, SUSE-SU-2016:2658-1, SUSE-SU-2016:2657-1
SLES for SAP 12 kgraft-patch-SLE12_Update_16 1-2.1 SUSE-SU-2016:2593-1
SLES for SAP 12 kgraft-patch-SLE12_Update_9 6-5.1 SUSE-SU-2016:2636-1
SLES for SAP 11 SP4 kernel-ec2 +7 3.0.101-84.1 SUSE-SU-2016:2585-1
SLE Real Time 12 SP1 kernel-rt +5 3.12.67-60.27.1 SUSE-SU-2016:3304-1
SLE Real Time 11 SP4 kernel-rt +3 3.0.101.rt130-65.1 SUSE-SU-2016:3069-1
SLE Live Patching 12 kgraft-patch-SLE12-SP1_Update_0 7-20.2 SUSE-SU-2016:2631-1
SLE Live Patching 12 kgraft-patch-SLE12-SP1_Update_1 7-2.1 SUSE-SU-2016:2630-1
SLE Live Patching 12 kgraft-patch-SLE12-SP1_Update_2 6-2.1 SUSE-SU-2016:2629-1
SLE Live Patching 12 kgraft-patch-SLE12-SP1_Update_3 5-2.1 SUSE-SU-2016:2634-1
SLE Live Patching 12 kgraft-patch-SLE12-SP1_Update_4 +2 4-2.1 SUSE-SU-2016:2638-1, SUSE-SU-2016:2637-1, SUSE-SU-2016:2635-1
SLE Live Patching 12 kgraft-patch-SLE12-SP1_Update_7 3-5.1 SUSE-SU-2016:2673-1
SLE Live Patching 12 kgraft-patch-SLE12-SP1_Update_8 1-2.2 SUSE-SU-2016:2592-1
SUSE OpenStack Cloud 5 kernel-ec2 +6 3.0.101-0.47.90.1 SUSE-SU-2016:2614-1
SUSE Manager Proxy 2.1 kernel-ec2 +6 3.0.101-0.47.90.1 SUSE-SU-2016:2614-1
SUSE Manager 2.1 kernel-ec2 +6 3.0.101-0.47.90.1 SUSE-SU-2016:2614-1
SUSE Linux Enterprise Point of Sale 11 SP3 kernel-ec2 +6 3.0.101-0.47.90.1 SUSE-SU-2016:2614-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kernel-source 4.8.13-1.1 openSUSE-SU-2024:10128-1
openSUSE Leap 15.1 cri-o 1.17.1-lp151.2.2 openSUSE-SU-2020:0554-1
openSUSE Leap 15.1 cri-tools 1.18.0-lp151.2.1 openSUSE-SU-2020:0554-1
openSUSE Leap 15.1 go1.14 1.14-lp151.6.1 openSUSE-SU-2020:0554-1
openSUSE Leap 15.1 kubernetes 1.18.0-lp151.5.1 openSUSE-SU-2020:0554-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 dtrace-modules-3.8.13-118.13.3.el6uek 0.4.5-3.el6 ELSA-2016-3633
Oracle Linux 7 dtrace-modules-3.8.13-118.13.3.el7uek 0.4.5-3.el7 ELSA-2016-3633
Oracle Linux 7 dtrace-modules-4.1.12-61.1.16.el6uek 0.5.3-2.el6 ELSA-2016-3632
Oracle Linux 7 dtrace-modules-4.1.12-61.1.16.el7uek 0.5.3-2.el7 ELSA-2016-3632
Oracle Linux 7 kernel-uek +5 3.8.13-118.13.3.el7uek ELSA-2016-3633, ELSA-2016-3632
Oracle Linux 7 perf +11 3.10.0-327.36.3.el7 ELSA-2016-2098

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 67 repositories · most starred shown

  • timwr/CVE-2016-5195 ★ 1,022 · Oct 21, 2016

    CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android

  • firefart/dirtycow ★ 932 · Nov 25, 2016

    Dirty Cow exploit - CVE-2016-5195

  • scumjr/dirtycow-vdso ★ 511 · Oct 22, 2016

    PoC for Dirty COW (CVE-2016-5195)

  • gbonacini/CVE-2016-5195 ★ 340 · Oct 23, 2016

    A CVE-2016-5195 exploit example.

  • r1is/CVE-2022-0847 ★ 281 · Mar 7, 2022

    CVE-2022-0847-DirtyPipe-Exploit CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞,可覆盖重写任意可读文件中的数据,从而可将普通权限的用户提升到特权 root。 CVE-2022-0847 的漏洞原理类似于 CVE-2016-5195 脏牛漏洞(Dirty Cow),但它更容易被利用。漏洞作者将此漏洞命名…

  • hyln9/VIKIROOT ★ 271 · Jan 20, 2017

    CVE-2016-5195 (Dirty COW) PoC for Android 6.0.1 Marshmallow

  • Brucetg/DirtyCow-EXP ★ 142 · May 27, 2018

    编译好的脏牛漏洞(CVE-2016-5195)EXP

  • DavidBuchanan314/cowroot ★ 32 · Oct 24, 2016

    Universal Android root tool based on CVE-2016-5195. Watch this space.

  • Mr-Ochobot/CVE-2016-5195 ★ 26 · Oct 14, 2026
  • aishee/scan-dirtycow ★ 16 · Oct 29, 2016

    Scan vuls kernel CVE-2016-5195 - DirtyCow

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 48

References