VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 07:26 UTC
← Dashboard

CVE-2022-0847

Dirty Pipe

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to …

Read full description
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.6/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.8: +1.17
  • Fresh EPSS: 92.80%: +0.46

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 29 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

infoq.com
Press · 12 May 2026, 07:00 · Copy Fail and Dirty Frag: Linux Page-Cache Exploits Target Every Major Distribution - infoq.com
CSO Online
Press · 11 May 2026, 07:00 · New ‘Dirty Frag’ exploit targets Linux kernel for root access - CSO Online
Dark Reading
Press · 11 May 2026, 07:00 · 'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros - Dark Reading
LinkedIn
Press · 09 May 2026, 07:00 · WARNING: New Critical Linux Vulnerability "Dirty Frag" Enables Root Access Across Every Major Linux Distribution - LinkedIn
Hackster.io
Press · 08 May 2026, 14:16 · Dirty Frag Is a Zero-Day Disaster for Linux - Hackster.io
See all 29 source documents
SC Media
Press · 08 May 2026, 07:00 · 'Dirty Frag' Linux zero-day exposes most distributions to LPE | news - SC Media
CyberSecurityNews
Press · 08 May 2026, 07:00 · Dirty Frag Linux Vulnerability Let Attackers Gain Root Privileges - PoC Released - CyberSecurityNews
wiz.io
Press · 08 May 2026, 07:00 · Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC - wiz.io
Security Affairs
Press · 08 May 2026, 07:00 · Dirty Frag: A new Linux privilege escalation vulnerability is already in the wild - Security Affairs
The Hacker News
Press · 08 May 2026, 07:00 · Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions - The Hacker News
BleepingComputer
Press · 08 May 2026, 07:00 · New Linux 'Dirty Frag' zero-day gives root on all major distros - BleepingComputer
Techzine Global
Press · 01 May 2026, 07:00 · Linux distributions worldwide targeted by the Copy Fail exploit - Techzine Global
Help Net Security
Press · 30 Apr 2026, 07:00 · Nine-year-old Linux kernel flaw enables reliable local privilege escalation (CVE-2026-31431) - Help Net Security
East Bay Municipal Utility District
Press · 06 Jan 2026, 18:48 · A clean bay requires dirty work - East Bay Municipal Utility District
Security Affairs
Press · 22 Aug 2022, 07:00 · 8-year-old Linux Kernel flaw DirtyCred is nasty as Dirty Pipe - Security Affairs
Android Police
Press · 02 May 2022, 07:00 · Google Pixel 6 gets its Dirty Pipe fix and improved haptics in the May update - Android Police
www.trendmicro.com
Press · 06 Apr 2022, 07:00 · Detecting Exploitation of Local Vulnerabilities Through Trend Micro Vision One and Cloud One - www.trendmicro.com
www.trendmicro.com
Press · 06 Apr 2022, 07:00 · Detecting Exploitation of Local Vulnerabilities Through Trend Micro Vision One and Cloud One - www.trendmicro.com
Oracle Blogs
Press · 24 Mar 2022, 07:00 · Find out what you’re missing with Ksplice Inspector - Oracle Blogs
Android Police
Press · 16 Mar 2022, 07:00 · Dirty Pipe: What is it, is my phone affected, what's being done to fix it, and do I need to be worried about it? - Android Police
Dark Reading
Press · 15 Mar 2022, 07:00 · NAS Vendor Says Several of Its Products Likely Contain Linux 'Dirty Pipe' Flaw - Dark Reading
Securelist
Press · 14 Mar 2022, 07:00 · Notes on CVE-2022-0847 (Dirty Pipe) vulnerability - Securelist
Palo Alto Networks
Press · 14 Mar 2022, 07:00 · DirtyPipe Enables Critical Attacks on Container Environments - Palo Alto Networks
Rapid7
Press · 09 Mar 2022, 08:00 · CVE-2022-0847: Arbitrary File Overwrite Vulnerability in Linux Kernel - Rapid7
Snyk
Press · 09 Mar 2022, 08:00 · "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) - Snyk
Sophos
Press · 08 Mar 2022, 08:00 · “Dirty Pipe” Linux kernel bug lets anyone write to any file - Sophos
Infosecurity Magazine
Press · 08 Mar 2022, 08:00 · Dirty Pipe Exploit Rings Alarm Bells in the Linux Community - Infosecurity Magazine
The Hacker News
Press · 08 Mar 2022, 08:00 · Researchers Warn of Linux Kernel ‘Dirty Pipe’ Arbitrary File Overwrite Vulnerability - The Hacker News
BankInfoSecurity
Press · 07 Mar 2022, 08:00 · 'Dirty Pipe' Permission Flaw Patched in Linux Kernel - BankInfoSecurity

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.6 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

16

Public exploit entries / repo candidates

See 16 repos with metrics
RepositoryStarsForksLanguageUpdated
DataDog/dirtypipe-container-breakout-poc7712—20 Apr 2022, 20:23
greenhandatsjtu/CVE-2022-0847-Container-Escape376C07 May 2026, 18:44
chenaotian/CVE-2022-0847257C10 Mar 2022, 01:31
breachnix/dirty-pipe-poc154C14 Mar 2022, 20:34
crusoe112/DirtyPipePython118Python23 Mar 2022, 22:46
LudovicPatho/CVE-2022-0847_dirty-pipe104C05 Apr 2022, 20:33
0xlane/pagecache-guard72Python11 May 2026, 06:31
byteReaper77/Dirty-Pipe31C19 Apr 2025, 17:43
gyaansastra/CVE-2022-084732C20 Mar 2022, 15:46
jpts/CVE-2022-0847-DirtyPipe-Container-Breakout32C20 Apr 2022, 22:07
0xeremus/dirty-pipe-poc21Python20 Jun 2023, 23:48
CYB3RK1D/CVE-2022-0847-POC22C15 Mar 2022, 17:41
ajith737/Dirty-Pipe-CVE-2022-0847-POCs03C04 Jan 2023, 12:51
MingqiZhang7710/cve-2022-0847-poc-dockerimage00—07 Aug 2025, 09:31
nanaao/Dirtypipe-exploit01—09 Mar 2022, 04:43
stfnw/reproducer-poc-CVE-2022-084700Rust28 Jan 2026, 13:29
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.8; EPSS 92.8%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
local access, low privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:34.147896+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
07 Mar 2022, 00:00
First press mention
07 Mar 2022, 08:00
Added to the CISA KEV catalog
25 Apr 2022, 00:00
Latest press mention
12 May 2026, 07:00
Score calculated
05 Nov 2026, 13:58
Name
Dirty Pipe
PoCs on GitHub
16 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar