Linux Kernel Dirty Pipe Local Privilege Escalation Vulnerability (CVE-2022-0847)
Executive & SecOps Summary
SECOPS ASSESSMENTLinux kernel versions 5.8 and outstanding up to versions prior to 5.16.11, 5.15.25, and 5.10.102
An unprivileged local user can write arbitrary data to the page cache of read-only files, leading to full root privilege escalation
Immediately upgrade the Linux kernel to the latest patched stable release and reboot the system
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the kernel to the latest stable version using your distribution's package manager and reboot the system to apply changes.
# For Ubuntu / Debian systems
sudo apt-get update && sudo apt-get install --only-upgrade -y linux-image-generic
sudo reboot
# For RHEL / Rocky Linux / AlmaLinux systems
sudo dnf update -y kernel
sudo reboot2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict compiler access to prevent local compilation of exploit payloads, and limit SSH access to trusted users.
# Restrict compiler execution permissions
sudo chmod 700 /usr/bin/gcc /usr/bin/g++ /usr/bin/make 2>/dev/null || true
# Monitor active sessions and restrict local access via SSH configuration3. Log Audit & IoC Verification Commands
Verify the current running kernel version and audit SUID binaries for unauthorized modifications.
# Check current running kernel version
uname -r
# Audit recently modified SUID binaries which might indicate exploitation attempts
find / -perm -4000 -type f -mtime -1 2>/dev/nullBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability, publicly known as 'Dirty Pipe', resides in the Linux kernel's pipe buffer handling mechanism. The root cause is a lack of proper initialization of the flags member in the pipe_buffer structure within the copy_page_to_iter_pipe and push_pipe functions (CWE-665). Consequently, stale flag values, specifically PIPE_BUF_FLAG_CAN_MERGE, can persist across page allocations.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits this by first filling a pipe with data to ensure the PIPE_BUF_FLAG_CAN_MERGE flag is set on all pipe buffers, and then draining the pipe. Next, the attacker uses the splice() system call to merge a page from a read-only file (such as /etc/passwd or a SUID binary) into the pipe. Because the stale merge flag remains active, the kernel incorrectly permits subsequent write operations to the pipe to overwrite the page cache of the read-only file directly in memory. This allows the attacker to inject arbitrary data into privileged files without requiring write permissions.
3. Infrastructure & Business Impact
With a CVSS score of 7.8 (High) and an EPSS score of 0.928, this vulnerability is highly critical and has been actively exploited in the wild (CISA KEV). A local attacker can achieve instant root access, bypassing standard access controls. In containerized environments, this flaw can be leveraged to perform container escape attacks, compromising the underlying host and adjacent tenant environments.
Official Vendor Advisories & References
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
Frequently Asked SecOps Questions (CVE-2022-0847)
FAQQ1. How critical is CVE-2022-0847 and is it actively exploited in the wild?
CVE-2022-0847 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 92.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-0847?
Primary impacted vendors include linux across linux_kernel. Scope summary: Linux Kernel versions 5.8 and above, prior to 5.16.11, 5.15.25, and 5.10.102
Q3. What temporary mitigations or workarounds exist for CVE-2022-0847 before patching?
[Mitigation] Immediately upgrade the Linux kernel to the latest patched stable release and reboot the system Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-0847
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (linux)
View Category →Linux Kernel IPv6 Socket Memory Corruption Vulnerability (CVE-2026-53362) Analysis and Mitigation Guide
[Affected Scope] Linux kernel systems utilizing UDPv6 sockets with MSG_MORE and MSG_SPLICE_PAGES flags
Linux Kernel algif_aead In-place Operation Vulnerability Leading to Local Privilege Escalation (CVE-2026-31431)
[Affected Scope] Systems running Linux kernel with the `algif_aead` crypto subsystem module enabled.
Linux Kernel Netfilter Bridge ebt_snat ARP Rewrite Vulnerability (CVE-2026-53266)
[Affected Scope] Linux systems utilizing ebtables SNAT targets within bridge netfilter configurations.
Linux Kernel Memory Corruption via Missing Shared-Frag Marker in skbuff (CVE-2026-46300)
[Affected Scope] Linux kernel network stack (skbuff) and systems utilizing IPsec (ESP).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.