CVE-2016-5195

HIGH KEV LAB

Linux Kernel 2.x-4.x < 4.8.3 - Local Privilege Escalation via Dirty COW Race Condition

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2016-5195 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 3, 2022. EIP tracks 72 public exploits from researchers including FireFart, Gabriele Bonacini, Robin Verton.

AI-analyzed exploit summary This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to overwrite the /etc/passwd file, allowing privilege escalation by adding a new root user. It uses the ptrace_pokedata method to achieve a race condition and modify the file.

Description

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

Exploits (72)

exploitdb WORKING POC VERIFIED
by FireFart · clocallinux
https://www.exploit-db.com/exploits/40839

This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to overwrite the /etc/passwd file, allowing privilege escalation by adding a new root user. It uses the ptrace_pokedata method to achieve a race condition and modify the file.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Compilation of the exploit code with gcc
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Gabriele Bonacini · c++locallinux
https://www.exploit-db.com/exploits/40847

This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to gain root privileges by modifying the /etc/passwd file via a race condition in the Linux kernel's memory management. It spawns a root shell with a predefined password.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux Kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Write access to /etc/passwd
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Robin Verton · clocallinux
https://www.exploit-db.com/exploits/40616

This exploit leverages the DirtyCow vulnerability (CVE-2016-5195) to achieve local privilege escalation by racing the madvise system call with writes to /proc/self/mem, overwriting a SUID binary (e.g., /usr/bin/passwd) with a shellcode payload that spawns a root shell.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel < 4.8.3 (with specific configurations)
No auth needed
Prerequisites: Local access to the target system · SUID binary with read permissions · Vulnerable Linux kernel version
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Phil Oester · clocallinux
https://www.exploit-db.com/exploits/40611

This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to achieve local privilege escalation by racing the madvise(MADV_DONTNEED) system call while writing to /proc/self/mem, allowing an attacker to overwrite read-only files.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel versions before 4.8.3, 4.7.9, and 4.4.26
No auth needed
Prerequisites: Local access to the target system · Read-only file to overwrite
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Phil Oester · clocallinux
https://www.exploit-db.com/exploits/40838

This exploit leverages the Dirty COW vulnerability (CVE-2016-5195) to perform a race condition attack between madvise and ptrace system calls, allowing local privilege escalation by overwriting read-only files.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux Kernel < 4.8.3
No auth needed
Prerequisites: Local access to the target system · Read access to a target file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 991 stars
by timwr · local
https://github.com/timwr/CVE-2016-5195

This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation on vulnerable Android devices. The exploit leverages the race condition in the Linux kernel's memory management to overwrite read-only files, achieving root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (Android devices)
No auth needed
Prerequisites: Vulnerable Linux kernel (pre-patch for CVE-2016-5195) · ADB access to the target device
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 921 stars
by firefart · local
https://github.com/firefart/dirtycow

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings. The exploit modifies the /etc/passwd file to create a new root user with a specified password, demonstrating a local privilege escalation (LPE) attack.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Compile the exploit with gcc
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 508 stars
by scumjr · local
https://github.com/scumjr/dirtycow-vdso

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), targeting the vDSO (virtual Dynamic Shared Object) to achieve local privilege escalation. The exploit uses a race condition in the Linux kernel's memory management to overwrite read-only memory mappings, specifically hijacking the `clock_gettime` function to execute arbitrary code.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (versions prior to the fix for CVE-2016-5195)
No auth needed
Prerequisites: Local access to the target system · Unpatched Linux kernel vulnerable to CVE-2016-5195
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 330 stars
by gbonacini · local
https://github.com/gbonacini/CVE-2016-5195

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies the /etc/passwd file to grant root access with a predefined password, and includes both C++ and Golang implementations.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (multiple versions, see README for details)
No auth needed
Prerequisites: Vulnerable Linux kernel (pre-patch for CVE-2016-5195) · Unprivileged user access
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 280 stars
by r1is · local
https://github.com/r1is/CVE-2022-0847

This repository contains a proof-of-concept exploit for CVE-2022-0847 (Dirty Pipe), which allows overwriting any file contents in the page cache, even if the file is read-only or immutable. The exploit demonstrates privilege escalation by modifying the /etc/passwd file to gain root access without a password.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel 5.8 and later
No auth needed
Prerequisites: Linux kernel 5.8 or later · Access to a local user account
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 271 stars
by hyln9 · poc
https://github.com/hyln9/VIKIROOT

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW) targeting 64-bit Android 6.0.1 Marshmallow. The exploit leverages the Dirty COW vulnerability to achieve local privilege escalation (LPE) by modifying the vDSO region in memory, bypassing SELinux, and providing a stable root shell without modifying the filesystem.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Android 6.0.1 Marshmallow (64-bit)
No auth needed
Prerequisites: A vulnerable Android device running 64-bit Android 6.0.1 Marshmallow · A patched sepolicy to allow init domain unconfined access · NDK standalone toolchain for building the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SUSPICIOUS 139 stars
by Brucetg · poc
https://github.com/Brucetg/DirtyCow-EXP

The repository claims to provide a precompiled exploit for CVE-2016-5195 (DirtyCow) but only contains a README with a link to an external blog post. No actual exploit code or technical details are included.

Classification
Suspicious 80%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (versions prior to 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: Local access to the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 31 stars
by DavidBuchanan314 · poc
https://github.com/DavidBuchanan314/cowroot

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. The PoC patches the `getuid` and `geteuid` functions in libc to return 0, effectively bypassing privilege checks on CyanogenMod devices.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Android (32-bit, CyanogenMod with patched getuid/geteuid)
No auth needed
Prerequisites: 32-bit Android device · CyanogenMod with patched getuid/geteuid · Write access to /data/local/tmp
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 16 stars
by aishee · poc
https://github.com/aishee/scan-dirtycow

This repository contains a bash script that scans for the presence of vulnerable kernel versions affected by CVE-2016-5195 (Dirty Cow). It checks the current kernel version against a hardcoded list of known vulnerable versions and reports whether the system is vulnerable, mitigated, or safe.

Classification
Scanner 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Linux Kernel (various versions)
No auth needed
Prerequisites: Access to the target system to run the script
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 13 stars
by xlucas · local
https://github.com/xlucas/dirtycow.cr

This repository contains a Crystal language implementation of the Dirty COW (CVE-2016-5195) exploit, which leverages a race condition in the Linux kernel's memory subsystem to achieve local privilege escalation. The exploit allows writing to read-only memory mappings, enabling an attacker to modify critical system files.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Write access to a file or memory mapping
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 10 stars
by pgporada · poc
https://github.com/pgporada/ansible-role-cve

This repository contains an Ansible role that mitigates CVE-2016-5195 (Dirty COW) by deploying a SystemTap module to patch the vulnerability. It includes tasks to check for the module, install dependencies, generate and load the module, and clean up afterward.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel ( Dirty COW vulnerability)
Auth required
Prerequisites: Root access to deploy the SystemTap module · SystemTap and kernel debug symbols installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 9 stars
by imust6226 · local
https://github.com/imust6226/dirtcow

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. The exploit modifies the /etc/passwd file to create a new root user with a specified password, leveraging a race condition in the kernel's memory handling.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel versions before 4.8.3, 4.7.9, and 4.4.26
No auth needed
Prerequisites: Access to a vulnerable Linux system · GCC compiler to build the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 9 stars
by whu-enjoy · local
https://github.com/whu-enjoy/CVE-2016-5195

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), specifically targeting the vDSO (virtual Dynamic Shared Object) to achieve local privilege escalation. The exploit leverages a race condition in the Linux kernel's memory management to overwrite read-only memory mappings.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (versions prior to the fix for CVE-2016-5195)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compilation tools (gcc, make, etc.)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC 8 stars
by codecat007 · cpoc
https://github.com/codecat007/cvehub/tree/main/android/kernel/cve-2016-5195

This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The provided PoC demonstrates the race condition between madvise and write operations to achieve local privilege escalation.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before the fix)
No auth needed
Prerequisites: Local access to the target system · Write permissions to a file
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 7 stars
by jas502n · local
https://github.com/jas502n/CVE-2016-5195

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies the /etc/passwd file to create a new root user with a specified password, leveraging a race condition in the kernel's memory management.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Compilation tools (gcc)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 7 stars
by sideeffect42 · local
https://github.com/sideeffect42/DirtyCOWTester

This repository contains a functional exploit PoC for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The code demonstrates the race condition between the `madvise` and `write` system calls to achieve arbitrary write access to read-only memory mappings.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Ability to compile and run C code
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 6 stars
by oleg-fiksel · poc
https://github.com/oleg-fiksel/ansible_CVE-2016-5195_check

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. It includes an Ansible playbook to automate the compilation and execution of the exploit, which leverages a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
Auth required
Prerequisites: Local user access with sudo privileges · GCC compiler for exploit compilation
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by talsim · local
https://github.com/talsim/root-dirtyc0w

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a race condition vulnerability in the Linux kernel's copy-on-write mechanism. The exploit overwrites a SUID binary (e.g., /bin/ping) with shellcode to achieve root privilege escalation.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before the fix for CVE-2016-5195)
No auth needed
Prerequisites: Access to a vulnerable Linux system · SUID binary to overwrite
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by droidvoider · local
https://github.com/droidvoider/dirtycow-replacer

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), specifically designed for Android devices. It includes a tool to replace files using the Dirty COW vulnerability, with a focus on educational and testing purposes.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (Android devices)
No auth needed
Prerequisites: Android device with USB debugging enabled · Android SDK & NDK · Linux environment for compilation
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by arttnba3 · local
https://github.com/arttnba3/CVE-2016-5195

This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. It includes a proof-of-concept for arbitrary file writes and two exploits for gaining root access via /etc/passwd manipulation or SUID binary overwriting.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Readable target file for arbitrary write PoC
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by LinuxKernelContent · local
https://github.com/LinuxKernelContent/DirtyCow

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition in the copy-on-write mechanism to gain root access by overwriting a SUID binary.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux Kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Compilation environment with gcc and pthread support
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB 3 stars
by esc0rtd3w · poc
https://github.com/esc0rtd3w/org.cowpoop.moooooo

This repository contains an incomplete Android APK project based on CVE-2016-5195 (DirtyCOW) but lacks functional exploit code. The README explicitly states it is non-working and under development.

Classification
Stub 95%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Linux kernel (Android devices)
No auth needed
Prerequisites: Android device with vulnerable kernel
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by LiEnby · local
https://github.com/LiEnby/PSSRoot

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The code includes native C implementations of the exploit (dirtycow.c) and a C# wrapper for executing the exploit via ADB on Android devices.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Android device with ADB access · Vulnerable Linux kernel version
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by FloridSleeves · poc
https://github.com/FloridSleeves/os-experiment-4

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses race conditions between madvise and /proc/self/mem writes to overwrite the getuid function in libc, achieving root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compiler (gcc) to build the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by 0x3n19m4 · local
https://github.com/0x3n19m4/CVE-2016-5195

This is a functional exploit for CVE-2016-5195 (Dirty COW), a race condition in the Linux kernel's memory subsystem. It uses concurrent threads to trigger a race between madvise(MADV_DONTNEED) and write operations to gain write access to read-only memory mappings, allowing privilege escalation by modifying /etc/passwd.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Write access to /proc/self/mem
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by TotallyNotAHaxxer · local
https://github.com/TotallyNotAHaxxer/CVE-2016-5195

This repository contains a functional Go implementation of the Dirty COW (CVE-2016-5195) exploit, which leverages a race condition in the Linux kernel's memory subsystem to achieve local privilege escalation. The exploit overwrites the SUID binary `/usr/bin/passwd` with a payload that spawns a root shell.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Write access to `/proc/self/mem` · SUID binary to overwrite (e.g., `/usr/bin/passwd`)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by th3-5had0w · local
https://github.com/th3-5had0w/DirtyCOW-PoC

This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (DirtyCOW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings, allowing an attacker to modify files they would otherwise not have permission to write to.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Ability to compile and execute the exploit code
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by DanielEbert · local
https://github.com/DanielEbert/CVE-2016-5195

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating a local privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition in the copy-on-write mechanism to gain write access to read-only memory mappings, allowing an attacker to overwrite files and escalate privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Compilation tools (e.g., Android NDK for Android targets)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 1 stars
by titanhp · poc
https://github.com/titanhp/Dirty-COW-CVE-2016-5195-Testing

This repository contains a script to detect the presence of the Dirty COW vulnerability (CVE-2016-5195) by checking the kernel version against a list of known vulnerable versions. It does not include an exploit but provides a mitigation status check.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Linux Kernel (various versions)
No auth needed
Prerequisites: Access to the target system to run the script
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by arbll · poc
https://github.com/arbll/dirtycow

This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to gain root access by overwriting the SUID binary `/usr/bin/passwd`.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Ability to compile and execute C code
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by ASRTeam · local
https://github.com/ASRTeam/CVE-2016-5195

The repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating a race condition in the Linux kernel's memory management subsystem to achieve local privilege escalation by modifying read-only files.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Read-only file to modify
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by SaanviShah30 · poc
https://github.com/SaanviShah30/IoT-Firmware-Reverse-Engineering

This repository documents a firmware reverse engineering project on an IoT camera, identifying multiple vulnerabilities including CVE-2016-5195 (DirtyCOW). It provides a detailed technical analysis of the vulnerabilities, tools used, and mitigation recommendations.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: IoT Camera Firmware (unspecified version)
No auth needed
Prerequisites: Firmware binary · Binwalk · IDA Pro · Wireshark
devstral-2 · analyzed May 20, 2026 Full analysis →
nomisec WRITEUP
by maur0amaya · poc
https://github.com/maur0amaya/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow

This repository provides a conceptual overview of the Dirty COW (CVE-2016-5195) kernel exploit, describing a realistic privilege escalation scenario. However, it lacks actual exploit code or technical deep-dive details.

Classification
Writeup 80%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (versions before 4.8.3, 4.7.9, 4.4.26)
Auth required
Prerequisites: local access to the target system · unpatched Linux kernel
devstral-2 · analyzed May 19, 2026 Full analysis →
gitlab WRITEUP
by nu11secur1ty · poc
https://gitlab.com/nu11secur1ty/Protect-CVE-2016-5195-DirtyCow

This repository provides a detailed technical writeup on mitigating CVE-2016-5195 (Dirty Cow), including patching instructions, temporary fixes using systemtap, and testing methods. It does not contain exploit code but offers in-depth guidance on protection and verification.

Classification
Writeup 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (multiple distributions)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Root privileges for mitigation steps
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WORKING POC
by Nathanloupy · poc
https://github.com/Nathanloupy/42adv_boot2root

This repository contains functional exploit code for CVE-2016-5195 (Dirty COW), including multiple variants targeting /etc/crontab, /etc/passwd, and other files. The exploits leverage the race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: Local access to the vulnerable system · Compilation tools (gcc)
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by theo543 · poc
https://github.com/theo543/OSDS_Paper_CVE-2016-5195

This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), a Linux privilege escalation vulnerability. The exploit demonstrates the race condition in the copy-on-write mechanism but lacks post-exploit steps to prevent kernel crashes due to writeback.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: Local access to a vulnerable Linux system
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by elhaddadalaa788-alt · poc
https://github.com/elhaddadalaa788-alt/kernel-exploit-dirtycow-project-subm

This repository provides a detailed writeup of a privilege escalation exploit using CVE-2016-5195 (Dirty COW) on Ubuntu 16.04. It includes high-level steps, proof of execution, and screenshots but does not contain actual exploit code.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (Ubuntu 16.04)
Auth required
Prerequisites: Vulnerable kernel version · Compilation environment matching victim libraries · Access to a limited user account on the victim system
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by ramahmdr · local
https://github.com/ramahmdr/dirtycow

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. The exploit modifies the /etc/passwd file to create a new root user by leveraging a race condition in the kernel's memory handling.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel versions 2.x to 4.x before 4.8.3
No auth needed
Prerequisites: Local access to the target system · Compilation tools (gcc)
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by pardhu045 · poc
https://github.com/pardhu045/linux-privilege-escalation

This repository provides a detailed technical walkthrough of exploiting CVE-2016-5195 (Dirty COW) for local privilege escalation on Metasploitable2, including step-by-step commands, troubleshooting, and validation steps.

Classification
Writeup 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
Auth required
Prerequisites: Access to a vulnerable Linux system with a low-privileged account · Compilation tools (gcc) on the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by MarioAlejos-Cs · local
https://github.com/MarioAlejos-Cs/dirtycow-lab

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation by modifying /etc/passwd to insert a root user with a known password. The exploit uses a race condition in the Linux kernel's memory management to achieve write access to read-only memory mappings.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel versions before 4.8.3, 4.7.9, and 4.4.26
No auth needed
Prerequisites: Access to a vulnerable Linux system with a kernel version affected by CVE-2016-5195 · Compilation environment to build the exploit binary
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WRITEUP
by OscarYR · poc
https://github.com/OscarYR/CVE_Reproduction/tree/main/Dirty Cow/CVE-2016-5195.md

This repository provides a detailed technical analysis of CVE-2016-5195 (Dirty Cow), including the root cause, exploitation steps, and mitigation strategies. It includes screenshots and references to external PoC exploits but does not contain functional exploit code itself.

Classification
Writeup 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (versions < 4.8.3)
Auth required
Prerequisites: Local access to a vulnerable Linux system · Low-privileged user account
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by mohammadamin382 · poc
https://github.com/mohammadamin382/dirtycow-lab

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition in the copy-on-write mechanism to modify read-only files, potentially allowing local privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux Kernel versions 2.6.22 to 4.8.2
No auth needed
Prerequisites: Vulnerable Linux kernel version · Local access to the system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by Samuel-G3 · poc
https://github.com/Samuel-G3/Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow

This repository provides a detailed writeup on exploiting CVE-2016-5195 (Dirty Cow), a Linux kernel vulnerability allowing local privilege escalation via a race condition. It includes steps for verification, compilation, and execution but lacks actual exploit code.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel ≤ 4.8.3
Auth required
Prerequisites: Local access to vulnerable system · Compilation tools (g++) · Transfer mechanism (scp)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by ASUKA39 · local
https://github.com/ASUKA39/CVE-2016-5195

This repository contains a functional exploit for CVE-2016-5195 (DirtyCOW), demonstrating a race condition in the Linux kernel's memory management that allows privilege escalation by writing to read-only files. The PoC includes a detailed technical analysis of the exploit mechanism and kernel internals.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Ability to compile and execute C code
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by sakilahamed · poc
https://github.com/sakilahamed/Linux-Kernel-Exploit-LAB

The repository contains only a README.md file with minimal information about CVE-2016-5195 (Dirty COW) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.

Classification
Stub 90%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Linux Kernel (versions prior to fix for Dirty COW)
No auth needed
Prerequisites: Access to a vulnerable Linux system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by ZhiQiAnSecFork · local
https://github.com/ZhiQiAnSecFork/DirtyCOW_CVE-2016-5195

This repository contains functional exploit code for CVE-2016-5195 (DirtyCOW), a Linux kernel privilege escalation vulnerability. It includes multiple PoC exploits (e.g., cowroot.c, dirtycow-mem.c) and detection scripts for various distributions.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 2016-10-18, specifically 2.6.22 and later)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · GCC compiler to build the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by EDLLT · local
https://github.com/EDLLT/CVE-2016-5195-master

This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. It includes compiled binaries and scripts to demonstrate privilege escalation by overwriting the 'run-as' binary to gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (Android devices)
No auth needed
Prerequisites: ADB access to the target device · Vulnerable Linux kernel (pre-patch for CVE-2016-5195)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by h1n4mx0 · poc
https://github.com/h1n4mx0/Research-CVE-2016-5195

This repository provides a detailed technical analysis of CVE-2016-5195 (Dirty Cow), explaining the race condition vulnerability in Linux kernel memory management and how it can be exploited for local privilege escalation. It includes a conceptual exploit code example and a walkthrough of the attack mechanism.

Classification
Writeup 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux Kernel (versions prior to fix)
Auth required
Prerequisites: Local access to a vulnerable Linux system · User-level permissions
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by fei9747 · local
https://github.com/fei9747/CVE-2016-5195

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition in the Linux kernel's memory subsystem to gain write access to read-only memory mappings. The exploit modifies the /etc/passwd file to create a new user with root privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Compilation tools (gcc)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by KaviDk · local
https://github.com/KaviDk/dirtyCow

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit leverages a race condition between madvise and procselfmem to gain write access to read-only memory mappings, allowing local users to escalate privileges.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
Auth required
Prerequisites: Local user access · Read-only file to modify
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by passionchenjianyegmail8 · poc
https://github.com/passionchenjianyegmail8/scumjrs

The repository contains only a README file with a brief mention of CVE-2016-5195 (Dirty COW) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Linux kernel (versions prior to fix for Dirty COW)
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SUSPICIOUS
by KasunPriyashan · poc
https://github.com/KasunPriyashan/Y2S1-Project-Linux-Exploitaion-using-CVE-2016-5195-Vulnerability

The repository contains no exploit code or technical details, only a vague description of exploiting CVE-2016-5195 (Dirty COW) for root access. It appears to be a placeholder or academic project summary without actionable content.

Classification
Suspicious 90%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Linux kernel < 4.8.3
No auth needed
Prerequisites: Local access to a vulnerable Linux system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by zakariamaaraki · local
https://github.com/zakariamaaraki/Dirty-COW-CVE-2016-5195-

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit uses a race condition between `madvise` and `proc/self/mem` to gain write access to read-only memory mappings, allowing an attacker to modify `/etc/group` and escalate privileges to root.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Ability to compile and execute the exploit binary
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by dulanjaya23 · poc
https://github.com/dulanjaya23/Dirty-Cow-CVE-2016-5195-

The repository contains only a README with a brief description of CVE-2016-5195 (Dirty Cow) but no actual exploit code or technical details. It appears to be a placeholder or incomplete repository.

Classification
Stub 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Theoretical
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: Local access to a vulnerable Linux system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by shanuka-ashen · poc
https://github.com/shanuka-ashen/Dirty-Cow-Explanation-CVE-2016-5195-

The repository contains only a README.md file with a title and no substantive content or exploit code. It appears to be a placeholder or incomplete repository.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Linux kernel (unspecified version)
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
gitlab WRITEUP
by nu11secur1ty · poc
https://gitlab.com/nu11secur1ty/Protect-CVE-2016-5195-DirtyCow-deletion_scheduled-17340278

This repository provides a detailed technical writeup on mitigating CVE-2016-5195 (Dirty Cow), including patching instructions, temporary fixes using systemtap, and testing methods. It does not contain exploit code but offers in-depth guidance on protection and verification.

Classification
Writeup 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (multiple versions)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Root privileges for patching
devstral-2 · analyzed Jun 08, 2026 Full analysis →
nomisec WORKING POC
by xpcmdshell · poc
https://github.com/xpcmdshell/derpyc0w

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), which leverages a race condition to overwrite a read-only SUID executable with a custom ELF payload. The payload elevates privileges via setuid(0), modifies kernel parameters to prevent crashes, and spawns a root shell.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions prior to the fix for CVE-2016-5195)
No auth needed
Prerequisites: A root-owned SUID executable with read access · ptrace not restricted on the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by acidburnmi · poc
https://github.com/acidburnmi/CVE-2016-5195-master

This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), demonstrating privilege escalation on vulnerable Android devices via ADB. The exploit leverages the race condition in the Linux kernel's memory subsystem to overwrite read-only memory mappings, allowing arbitrary code execution as root.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (Android devices)
No auth needed
Prerequisites: Vulnerable Linux kernel (pre-patch for CVE-2016-5195) · ADB access to the target Android device
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by sribaba · local
https://github.com/sribaba/android-CVE-2016-5195

This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW) targeting Android devices. It includes compiled binaries and scripts to demonstrate privilege escalation by overwriting the 'run-as' binary to gain root access.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (Android devices)
No auth needed
Prerequisites: Vulnerable Android device with ADB access · NDK for compilation
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER
by ndobson · poc
https://github.com/ndobson/inspec_CVE-2016-5195

This repository contains an Inspec profile for detecting CVE-2016-5195 (Dirty COW), a Linux kernel privilege escalation vulnerability. It downloads and compiles a known exploit script to test for vulnerability by attempting to modify a read-only file.

Classification
Scanner 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel 2.x through 4.x before 4.8.3
No auth needed
Prerequisites: Local access to the target system · GCC compiler installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by ldenevi · local
https://github.com/ldenevi/CVE-2016-5195

This repository contains a functional proof-of-concept exploit for CVE-2016-5195 (Dirty COW), a race condition vulnerability in the Linux kernel's Copy-on-Write mechanism. The exploit leverages a race between madvise and /proc/self/mem writes to achieve local privilege escalation.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compilation tools (gcc, make)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by istenrot · poc
https://github.com/istenrot/centos-dirty-cow-ansible

This repository provides an Ansible playbook for mitigating CVE-2016-5195 (Dirty COW) on CentOS/Scientific Linux systems using SystemTap. It automates the installation of kernel debuginfo packages and SystemTap, then deploys a SystemTap module to mitigate the vulnerability.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Linux Kernel (CentOS/Scientific Linux)
Auth required
Prerequisites: CentOS/Scientific Linux system · Ansible · SystemTap · Kernel debuginfo packages
devstral-2 · analyzed Feb 18, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/Danyw24/dirtycow2-

This repository contains a functional exploit for CVE-2016-5195 (Dirty COW), a privilege escalation vulnerability in the Linux kernel. The exploit manipulates the /etc/passwd file to gain root access by leveraging a race condition in the copy-on-write mechanism.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, and 4.4.26)
No auth needed
Prerequisites: Local access to the target system · Write access to /etc/passwd
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/B1ackCat/cve-2016-5195-DirtyCOW

This repository contains functional exploit code for CVE-2016-5195 (DirtyCOW), a privilege escalation vulnerability in the Linux kernel. The exploit modifies /etc/passwd to create a new user with root privileges using race conditions between ptrace and /proc/self/mem.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: Linux kernel (versions before 4.8.3, 4.7.9, 4.4.26)
No auth needed
Prerequisites: local access to the target system · ability to compile and execute the exploit
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/Jekyll-Hyde2022/PrivEsc-Linux

This repository contains a functional exploit for CVE-2016-5195 (DirtyCow), a privilege escalation vulnerability in the Linux kernel. The exploit uses PTRACE_POKEDATA to overwrite a SUID binary with shellcode, granting root access. The code is well-documented and includes both x86 and x64 payloads.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (versions vulnerable to DirtyCow)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Compilation tools (gcc)
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb SUSPICIOUS
local
https://github.com/l0veormiss/l0veormiss.github.io

The repository claims to be a reverse shell generator but lacks actual exploit code for CVE-2026-5195. It contains a web-based tool for generating reverse shells, which is unrelated to the specified CVE.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: N/A
No auth needed
Prerequisites: N/A
devstral-2 · analyzed Feb 25, 2026 Full analysis →

References (128)

Core 128
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2107.html
Broken Link, Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:0372
Permissions Required, Third Party Advisory x_refsource_confirm
https://bto.bluecoat.com/security-advisory/sa134
Patch, Third Party Advisory x_refsource_confirm
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Third Party Advisory x_refsource_misc
https://dirtycow.ninja
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40847/
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2118.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2128.html
Third Party Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2016-12-01.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2120.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/26/7
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2133.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2098.html
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/243144
Issue Tracking x_refsource_confirm
https://bugzilla.suse.com/show_bug.cgi?id=1004418
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037078
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20161025-0001/
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/93793
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2127.html
Issue Tracking, Third Party Advisory x_refsource_confirm
https://security-tracker.debian.org/tracker/CVE-2016-5195
Third Party Advisory x_refsource_misc
https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
Exploit, Third Party Advisory x_refsource_misc
https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
Exploit, Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1384344
Third Party Advisory x_refsource_confirm
https://access.redhat.com/security/vulnerabilities/2706661
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2106.html
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40611/
Third Party Advisory x_refsource_confirm
https://access.redhat.com/security/cve/cve-2016-5195
Third Party Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2016-11-01.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2124.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2105.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2126.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2132.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-2110.html
Broken Link, Third Party Advisory x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10176
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/27/13
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3106-2
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3106-3
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/archive/1/540736/100/0/threaded
Third Party Advisory x_refsource_confirm
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10770
Broken Link, Third Party Advisory x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10177
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3105-2
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3107-1
Third Party Advisory x_refsource_confirm
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10774
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3107-2
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/540344/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3106-1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3106-4
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/30/1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3104-2
Third Party Advisory x_refsource_confirm
http://fortiguard.com/advisory/FG-IR-16-063
Third Party Advisory x_refsource_confirm
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10807
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/539611/100/0/threaded
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/archive/1/540252/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3105-1
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/139286/DirtyCow-Linux-Kernel-Race-Condition.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/03/7
Broken Link, Third Party Advisory x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10222
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3696
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/139287/DirtyCow-Local-Root-Proof-Of-Concept.html
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/archive/1/540344/100/0/threaded
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/archive/1/539611/100/0/threaded
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3104-1
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/540736/100/0/threaded
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/10/21/1
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/540252/100/0/threaded
Third Party Advisory x_refsource_confirm
https://security.paloaltonetworks.com/CVE-2016-5195
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/03/07/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/08/08/2
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/08/08/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/08/08/7
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/08/08/8
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/08/09/4
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2022/08/15/1
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40616/
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40839/

Scores

CVSS v3 7.0
EPSS 0.9393
EPSS Percentile 99.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Lab Environment

COMMUNITY
Community Lab
docker pull fnichol/uhttpd
+63 more repos

Details

CISA KEV 2022-03-03
VulnCheck KEV 2016-10-18
InTheWild.io 2016-10-18
ENISA EUVD EUVD-2016-6146
CWE
CWE-362
Status published
Products (31)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 16.10
debian/debian_linux 7.0
debian/debian_linux 8.0
fedoraproject/fedora 23
fedoraproject/fedora 24
fedoraproject/fedora 25
linux/linux_kernel 2.6.22 - 3.2.83
... and 21 more
Published Nov 10, 2016
KEV Added Mar 03, 2022
Tracked Since Feb 18, 2026