CVE-2016-5195: listed in the CISA KEV catalog CVE-2016-5195 · CVSS 7.0 HIGH · EPSS 84% · KEV 2022-03-03 · patch available
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Is CVE-2016-5195 exploited? Listed in the CISA KEV catalog on 2022-03-03. Federal remediation due 2022-03-24. Past that date by 1695 days. EPSS puts exploitation in the next 30 days at 84%. Public exploit code: functional. Which products and versions are affected? canonical · ubuntu linux · 12.04, 14.04, 16.04, 16.10 linux · linux kernel · >= 2.6.22, < 3.2.83, >= 3.3, < 3.4.113, >= 3.5, < 3.10.104, >= 3.11, < 3.12.66, >= 3.13, < 3.16.38, >= 3.17, < 3.18.44, +4 more redhat · enterprise linux · 5, 6.0, 7.0 redhat · enterprise linux aus · 6.2, 6.4, 6.5 redhat · enterprise linux eus · 6.6, 6.7, 7.1 redhat · enterprise linux long life · 5.6, 5.9 redhat · enterprise linux tus · 6.5 debian · debian linux · 7.0, 8.0 fedoraproject · fedora · 23, 24, 25 paloaltonetworks · pan-os · >= 5.1, < 7.0.14, >= 7.1.0, < 7.1.8 netapp · cloud backup netapp · hci storage nodes netapp · oncommand balance netapp · oncommand performance manager netapp · oncommand unified manager for clustered data ontap netapp · ontap select deploy administration utility netapp · snapprotect netapp · solidfire Is there a patch? Yes. Update to one of these or later:
linux kernel 2.6.22 3.2.83 linux kernel 3.3 3.4.113 linux kernel 3.5 3.10.104 linux kernel 3.11 3.12.66 linux kernel 3.13 3.16.38 linux kernel 3.17 3.18.44 linux kernel 3.19 4.1.35 linux kernel 4.2 4.4.26 linux kernel 4.5 4.7.9 linux kernel 4.8 4.8.3 pan-os 5.1 7.0.14 pan-os 7.1.0 7.1.8
From NVD's analysis
What PlainSec published about CVE-2016-5195 PlainSec has not published a story about this CVE.
Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-08-12.
CVE-2016-5195: listed in the CISA KEV catalog CVE-2016-5195 · CVSS 7.0 HIGH · EPSS 84% · KEV 2022-03-03 · patch available
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
Is CVE-2016-5195 exploited? Listed in the CISA KEV catalog on 2022-03-03. Federal remediation due 2022-03-24. Past that date by 1695 days. EPSS puts exploitation in the next 30 days at 84%. Public exploit code: functional. Which products and versions are affected? canonical · ubuntu linux · 12.04, 14.04, 16.04, 16.10 linux · linux kernel · >= 2.6.22, < 3.2.83, >= 3.3, < 3.4.113, >= 3.5, < 3.10.104, >= 3.11, < 3.12.66, >= 3.13, < 3.16.38, >= 3.17, < 3.18.44, +4 more redhat · enterprise linux · 5, 6.0, 7.0 redhat · enterprise linux aus · 6.2, 6.4, 6.5 redhat · enterprise linux eus · 6.6, 6.7, 7.1 redhat · enterprise linux long life · 5.6, 5.9 redhat · enterprise linux tus · 6.5 debian · debian linux · 7.0, 8.0 fedoraproject · fedora · 23, 24, 25 paloaltonetworks · pan-os · >= 5.1, < 7.0.14, >= 7.1.0, < 7.1.8 netapp · cloud backup netapp · hci storage nodes netapp · oncommand balance netapp · oncommand performance manager netapp · oncommand unified manager for clustered data ontap netapp · ontap select deploy administration utility netapp · snapprotect netapp · solidfire Is there a patch? Yes. Update to one of these or later:
linux kernel 2.6.22 3.2.83 linux kernel 3.3 3.4.113 linux kernel 3.5 3.10.104 linux kernel 3.11 3.12.66 linux kernel 3.13 3.16.38 linux kernel 3.17 3.18.44 linux kernel 3.19 4.1.35 linux kernel 4.2 4.4.26 linux kernel 4.5 4.7.9 linux kernel 4.8 4.8.3 pan-os 5.1 7.0.14 pan-os 7.1.0 7.1.8
From NVD's analysis
What PlainSec published about CVE-2016-5195 PlainSec has not published a story about this CVE.
Primary sources KEV and EPSS are re-checked daily. Record last updated 2026-08-12.