What’s Vulnerable › Vulnerabilities

CVE-2016-5195: Linux Kernel Race Condition Vulnerability

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-03
• EPSS: 83.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-11-10 · updated 2026-06-17
• Weakness: CWE-362

Description

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 16.10
• Debian Linux: 7.0, 8.0
• Fedoraproject Fedora: 23, 24, 25
• Linux kernel: from 2.6.22 before 3.2.83; from 3.3 before 3.4.113; from 3.5 before 3.10.104; from 3.11 before 3.12.66; from 3.13 before 3.16.38; from 3.17 before 3.18.44 — fixed in 3.10.104, 3.12.66, 3.16.38, 3.18.44, 3.2.83, 3.4.113
• NetApp Cloud Backup: all versions
• NetApp Hci Storage Nodes: all versions
• NetApp Oncommand Balance: all versions
• NetApp Oncommand Performance Manager: all versions
• NetApp Oncommand Unified Manager For Clustered Data Ontap: all versions
• NetApp ONTAP Select Deploy administration utility: all versions
• NetApp Snapprotect: all versions
• NetApp Solidfire: all versions
• Palo Alto Networks PAN-OS: from 5.1 before 7.0.14; from 7.1.0 before 7.1.8 — fixed in 7.0.14, 7.1.8
• Red Hat Enterprise Linux: 5, 6.0, 7.0
• RedHat Enterprise Linux Aus: 6.2, 6.4, 6.5
• RedHat Enterprise Linux Eus: 6.6, 6.7, 7.1
• RedHat Enterprise Linux Long Life: 5.6, 5.9
• RedHat Enterprise Linux Tus: 6.5

How to fix

Upgrade to a fixed version: Linux kernel 3.10.104, 3.12.66, 3.16.38, 3.18.44; Palo Alto Networks PAN-OS 7.0.14, 7.1.8. Check the vendor advisory for mitigations.

References

• http://fortiguard.com/advisory/FG-IR-16-063
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10770
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10774
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10807
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00035.html
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00036.html
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00038.html
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00039.html
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00045.html

Get alerted when CVE-2016-5195 or the next vulnerability affects your stack