CVE-2022-0847: listed in the CISA KEV catalog

CVE-2022-0847 · CVSS 7.8 HIGH · EPSS 89% · KEV 2022-04-25

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Is CVE-2022-0847 exploited?

• Listed in the CISA KEV catalog on 2022-04-25.
• Federal remediation due 2022-05-16.
• Past that date by 1552 days.
• EPSS puts exploitation in the next 30 days at 89%.
• Public exploit code: packaged in a public tool.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2022-0847

• Node Kernel Bugs on GKE COS Nodes Enable Host Escalation (2026-04-15)
• Google Cloud Issues Multiple Linux Kernel Privilege Escalation Fixes for GKE Nodes (2026-04-07)
• Multiple Linux Kernel Flaws Elevate Privileges on GCP Container Nodes (2026-04-03)
• Multiple High-Severity Cloud Vulnerabilities Impact Container Nodes (2026-04-01)

Primary sources

• NVD record
• CISA KEV catalog
• Metasploit: exploit/linux/local/cve_2022_0847_dirtypipe
• Exploit-DB 50808

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-15.