VDB
CVE-2016-5195
CVE-2016-5195
PUBLISHED
CVSS 7 HIGH
Reported by chrome · Published November 10, 2016
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| linux-lts | Arch Linux | 4.4.26-1 |
| linux-lts-vivid | Ubuntu:14.04:LTS | 3.19.0-73.81~14.04.1 |
| linux-raspi2 | Ubuntu:16.04:LTS | 4.4.0-1029.36 |
| linux-snapdragon | Ubuntu:16.04:LTS | 4.4.0-1032.36 |
| linux_kernel | linux | 4.8.3, 4.7.9, 4.4.26, 4.1.35, 3.18.44, 3.16.38, 3.12.66, 3.10.104, 3.4.113, 3.2.83 |
Risk scores
CVSS 3.1
7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| Linux | Linux kernel | |
| arch | linux-lts | 0 |
| n/a | n/a | * |
| arch | linux | 0 |
Timeline
- Sep 12, 2016 PoC Published (13 in total, the first dated here)
- Oct 18, 2016 VulnCheck KEV Exploitation (14 in total, the first dated here)
- Oct 19, 2016 CVE Published
- Oct 21, 2016 VulnCheck XDB Entry (56 in total, the first dated here)
- Feb 4, 2022 EPSS Score (30 in total, the first dated here)
- Mar 3, 2022 CISA KEV Added
- Nov 4, 2025 CVE Updated
- Mar 5, 2026 Distribution Patch (32 in total, the first dated here)
- Mar 5, 2026 Security Advisory (42 in total, the first dated here)
- Oct 8, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2016-5195
vulnetix vdb fixes CVE-2016-5195Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2016-5195/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- RHSA-2016:2107 vendor-advisoryx_refsource_REDHAT
- 40616 exploitx_refsource_EXPLOIT-DB
- RHSA-2017:0372 vendor-advisoryx_refsource_REDHAT
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- 40839 exploitx_refsource_EXPLOIT-DB
- x_refsource_MISC
- 40847 exploitx_refsource_EXPLOIT-DB
- RHSA-2016:2118 vendor-advisoryx_refsource_REDHAT
- RHSA-2016:2128 vendor-advisoryx_refsource_REDHAT
- x_refsource_CONFIRM
- RHSA-2016:2120 vendor-advisoryx_refsource_REDHAT
- [oss-security] 20161026 Re: CVE-2016-5195 "Dirty COW" Linux kernel privilege escalation vulnerability mailing-listx_refsource_MLIST
- RHSA-2016:2133 vendor-advisoryx_refsource_REDHAT
- RHSA-2016:2098 vendor-advisoryx_refsource_REDHAT
- x_refsource_CONFIRM
- VU#243144 third-party-advisoryx_refsource_CERT-VN
- x_refsource_CONFIRM
- 1037078 vdb-entryx_refsource_SECTRACK
…and 108 more