Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-05-16. Apply updates per vendor instructions.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
9 versions affected across 39 products
| Date | Total | Labels |
|---|
| 2026-01-28 | 1 | PoC1 |
| 2026-01-29 | 1 | General1 |
| 2026-03-05 | 1 | PoC1 |
| 2026-03-11 | 1 | General1 |
| 2026-04-05 | 1 | General1 |
| 2026-04-08 | 1 | Patch1 |
| 2026-04-09 | 1 | Active Exploitation1 |
| 2026-04-16 | 1 | General1 |
| 2026-04-25 | 1 | PoC1 |
| 2026-05-01 | 2 | False Positive1General1 |
| 2026-05-08 | 3 | Disclosure1General1Patch1 |
| 2026-05-09 | 1 | General1 |
| 2026-05-11 | 1 | General1 |
| 2026-05-12 | 1 | Active Exploitation1 |
| 2026-05-14 | 2 | General2 |
| 2026-05-15 | 1 | General1 |
| 2026-05-22 | 2 | General2 |
| 2026-06-01 | 1 | General1 |
| 2026-06-05 | 1 | General1 |
| 2026-07-25 | 1 | General1 |
| 2026-09-23 | 1 | General1 |
2026 Linux 重置密码教程大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)
Post summary
The content presents a list of Linux CVEs and their common names, but lacks details on attacks, PoCs, or mitigation information.
Linux 重置密码大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300) -PinTheft (CVE-2026-43494)
Post summary
The post catalogs Linux password reset methods linked to several CVEs but does not provide any PoC, exploit code, patch information, or evidence of active exploitation.
Them: Linux is most secure OS Me: Yes - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)
Post summary
A casual dialogue lists several Linux kernel CVEs without offering further technical context, patches, or exploitation details.
🚨 Alerta: vulnerabilidad en el kernel de Linux bautizada como "Dirty Frag" (también "Copy Fail 2"). Permite escalada local de privilegios a root. Es de la familia de Dirty Pipe (CVE-2022-0847). Divulgada el 7 de mayo de 2026. 🧵👇 https://x.com/v4bel/status/2052464007857185136
Post summary
The tweet announces a newly disclosed local privilege escalation vulnerability in the Linux kernel, dubbed "Dirty Frag" or "Copy Fail 2", part of the Dirty Pipe family (CVE‑2022‑0847), disclosed on May 7, 2026.
PWN The Penguin - From The Browser Instructor: @jeppojeps A hands-on primer on modern Linux kernel & glibc exploitation. Every flagship CVE is paired with the primitive its lecture teaches — the exploit is the lesson. All labs escalate to root, verified end-to-end. Curriculum, CVE-2023-32233 CVE-2021-3490 CVE-2022-0847 Support, 24/7 support via Discord — we've run this with a large cohort of students (happy to connect you with a few)., Average response time: under 1 hour., Dedicated DevOps on call for any lab/infra issues., Prereqs: basic x86/x64 asm · Linux kernel basics · the parent primer course.
Post summary
The post promotes a teaching course that covers several CVEs but does not supply PoC, exploit code, or technical vulnerability details.
2026 Linux 重置密码教程大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)
Post summary
The text lists several Linux CVEs as part of a password‑reset tutorial collection, but provides no PoC details, exploit code, patches, or evidence of active exploitation.
CVE-2026-31431 (Dirty Frag/Copy Fail) Linux kernel privilege escalation vulnerability was actively exploited 9+ days before public disclosure. ReversingLabs identified 163 unique samples across ELF binaries, Python scripts, and malicious PyPI packages. Key technical details: • CVE-2026-31431 exploits kernel page-cache manipulation similar to Dirty Pipe (CVE-2022-0847) for local privilege escalation • Earliest malicious sample observed April 29, 2026 - major surge began May 1 with 50+ samples overnight • Shellcode pattern uses compact syscalls: setuid(0), setgid(0), setgroups(0), then execve("/bin/sh") with TERM=xterm • Linux.Trojan.Multiverze family actively adopted the exploit; malicious PyPI wheel "copyfail" distributed via supply chain Attack methodology (MITRE ATT&CK): • T1068: Exploitation for Privilege Escalation via kernel vulnerability • T1548.001: Abuse setuid/setgid mechanisms for root credential normalization • T1195.002: Supply chain compromise through malicious PyPI package distribution • T1059.004/.006: Unix shell and Python interpreter abuse for payload execution DFIR artifacts and detection: • V4bel reference implementation uses distinctive opcode patterns: b06a0f05 (setgid), b0690f05 (setuid), b0740f05 (setgroups) • Co-occurrence of /bin/sh and TERM=xterm strings with syscall patterns provides high-confidence detection • AV detection rates currently 2-17 scanners, indicating signature gap #DFIR_Radar
Post summary
The post reports CVE‑2026‑31431 has been actively exploited for local privilege escalation via a kernel page‑cache flaw, with multiple weaponized samples and supply‑chain attacks, but provides no PoC or patch information.
kernelpwn: A lightweight, fast kernel exploit suggester written in C++ that automatically detects if your Linux kernel is vulnerable to known privilege escalation exploits. These are the vulnerabilities that kernelpwn can detect: 1. Dirty COW (CVE-2016-5195) 2. Dirty Pipe (CVE-2022-0847) 3. GameOver(lay) (CVE-2023-32629) 4. CVE-2024-1086 5. Copy Fail 6. Dirty Frag Github: https://github.com/gotr00t0day/kernelpwned #hacking #hacker #cybersecurity #cplusplus #coding #infosec #linux #linuxkernel #unix #pentesting #ethicalhacking #infosec #programming
Post summary
The post advertises a detection tool (kernelpwn) that flags several known kernel privilege escalation CVEs but provides no exploit code, patch, or active exploitation details.
Top 5 Trending CVEs: 1 - CVE-2026-3006 2 - CVE-2022-0847 3 - CVE-2026-6973 4 - CVE-2026-31431 5 - CVE-2026-29014 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
A list of five trending CVE identifiers is posted, without additional technical or contextual details.
The dataset: CVE-2021-3156 (sudo heap overflow), CVE-2022-0847 (Dirty Pipe), CVE-2023-38545 (curl SOCKS5). Real vulnerable functions from OpenSSL, Linux kernel, cURL.
Post summary
The statement lists three CVEs (CVE-2021-3156, CVE-2022-0847, CVE-2023-38545) with basic vulnerability descriptors and affected software, but offers no further detail or actionable information.
- Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300) -PinTheft (CVE-2026-43494)
Post summary
The entry lists several CVE identifiers with associated names but provides no additional information or context.
Top 5 Trending CVEs: 1 - CVE-2026-41940 2 - CVE-2026-23918 3 - CVE-2022-0847 4 - CVE-2026-0300 5 - CVE-2026-6973 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The tweet lists five trending CVEs with a link to a dashboard but provides no additional technical, exploit, or mitigation information.
Escape #3: Kernel Exploit Container shares the host kernel. Old kernel → container escape CVEs: - CVE-2022-0847 (DirtyPipe) - CVE-2022-0185 (heap overflow) - CVE-2020-14386 (AF_PACKET) Prevention: Patch your host kernel. Always.
Post summary
The post lists several old kernel CVEs and stresses that the host kernel should be patched to mitigate container escape risks.
https://portal.hunt.io/vulnerability/cve/CVE-2022-0847
Post summary
The text contains only a link to a CVE-2022-0847 portal page and does not provide explicit details about PoC, exploitation, active use, remediation, or vulnerability specifics.
2026 Linux 重置密码教程大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)
Post summary
The post simply lists several Linux CVE identifiers as part of a reset‑password tutorial, providing no further exploit, patch, or impact details.
Third page-cache LPE in 4 years: Dirty Pipe (CVE-2022-0847), Copy Fail (CVE-2026-31431), now Dirty Frag. Chains ESP (CVE-2026-43284, in mainline) + RxRPC (CVE-2026-43500, pending). Take the ESP fix today — it breaks the published chain even before RxRPC lands.
Post summary
The author lists recent page‑cache LPE exploits (Dirty Pipe, Copy Fail, Dirty Frag) and urges applying the ESP patch immediately to break the chain before the RxRPC vulnerability lands.
CVE-2026-31431 の spliceを使ってinodeは変更せずにpage cacheだけ変更するって、なんか似たようなの過去にもあったよなぁと思ったら、やっぱり CVE-2022-0847 が類似してると指摘する人がそこそこいた。
Post summary
The tweet notes that CVE-2026-31431 modifies page cache via splice without altering the inode, and comments on its similarity to CVE-2022-0847, but no evidence of exploitation or available patches is provided.
This looks like either misinformation or a poorly sourced claim—CVE-2026-31431 doesn't exist (we're still in 2024), and a 732-byte exploit for universal root across all Linux distros since 2017 would be the security story of the decade. Stick to verified CVEs like Dirty Pipe (CVE-2022-0847) if you want credible Linux privilege escalation info.
Post summary
The post debunks CVE‑2026‑31431 as a non‑existent entry and urges readers to focus on verified CVEs like Dirty Pipe.
A new AI review! Arinerron/CVE-2022-0847-DirtyPipe-Exploit ⭐2.7/5.0 This repository is a small, single-purpose proof-of-concept exploit for CVE-2022-0847 (Dirty Pipe), derived from Max Kellermann’s original PoC and... https://gitrated.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit
Post summary
The post announces a repository containing a proof‑of‑concept exploit for CVE‑2022‑0847 (Dirty Pipe).
Dirty Pipe (CVE-2022-0847) was just a rehearsal. The next Linux kernel write bug is already being discussed in private mailing lists. Here's your evergreen playbook to stop chasing CVEs forever. Read more: 👉 https://tinyurl.com/bdfksekx #AlmaLinux https://t.co/0Ilb74UYEL
Post summary
The tweet comments on CVE‑2022‑0847 as a rehearsal and hints at a playbook link, but offers no concrete technical info, PoC, exploit, patch, or exploitation evidence.
50 of 50 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | fedoraproject | fedora | 35 | - | - |
| OS | linux | linux_kernel | - | - | - |
| HW | netapp | h300e | - | - | - |
| OS | netapp | h300e_firmware | - | - | - |
| HW | netapp | h300s | - | - | - |
| OS | netapp | h300s_firmware | - | - | - |
| HW | netapp | h410c | - | - | - |
| OS | netapp | h410c_firmware | - | - | - |
| HW | netapp | h410s | - | - | - |
| OS | netapp | h410s_firmware | - | - | - |
| HW | netapp | h500e | - | - | - |
| OS | netapp | h500e_firmware | - | - | - |
| HW | netapp | h500s | - | - | - |
| OS | netapp | h500s_firmware | - | - | - |
| HW | netapp | h700e | - | - | - |
| OS | netapp | h700e_firmware | - | - | - |
| HW | netapp | h700s | - | - | - |
| OS | netapp | h700s_firmware | - | - | - |
| App | ovirt | ovirt-engine | 4.4.10.2 | - | - |
| App | redhat | codeready_linux_builder | - | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux_eus | 8.2 | - | - |
| OS | redhat | enterprise_linux_eus | 8.4 | - | - |
| OS | redhat | enterprise_linux_for_ibm_z_systems | 8.0 | - | - |
| OS | redhat | enterprise_linux_for_ibm_z_systems_eus | 8.2 | - | - |
| OS | redhat | enterprise_linux_for_ibm_z_systems_eus | 8.4 | - | - |
| OS | redhat | enterprise_linux_for_power_little_endian | 8.0 | - | - |
| OS | redhat | enterprise_linux_for_power_little_endian_eus | 8.2 | - | - |
| OS | redhat | enterprise_linux_for_power_little_endian_eus | 8.4 | - | - |
| OS | redhat | enterprise_linux_for_real_time | 8 | - | - |
| OS | redhat | enterprise_linux_for_real_time_for_nfv | 8 | - | - |
| OS | redhat | enterprise_linux_for_real_time_for_nfv_tus | 8.2 | - | - |
| OS | redhat | enterprise_linux_for_real_time_for_nfv_tus | 8.4 | - | - |
| OS | redhat | enterprise_linux_for_real_time_tus | 8.2 | - | - |
| OS | redhat | enterprise_linux_for_real_time_tus | 8.4 | - | - |
| OS | redhat | enterprise_linux_server_aus | 8.2 | - | - |
| OS | redhat | enterprise_linux_server_aus | 8.4 | - | - |
| OS | redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.1 | - | - |
| OS | redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.2 | - | - |
| OS | redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.4 | - | - |
| OS | redhat | enterprise_linux_server_tus | 8.2 | - | - |
| OS | redhat | enterprise_linux_server_tus | 8.4 | - | - |
| OS | redhat | enterprise_linux_server_update_services_for_sap_solutions | 8.1 | - | - |
| OS | redhat | enterprise_linux_server_update_services_for_sap_solutions | 8.2 | - | - |
| OS | redhat | enterprise_linux_server_update_services_for_sap_solutions | 8.4 | - | - |
| App | redhat | virtualization_host | 4.0 | - | - |
| HW | siemens | scalance_lpe9403 | - | - | - |
| OS | siemens | scalance_lpe9403_firmware | - | - | - |
| HW | sonicwall | sma1000 | - | - | - |
| OS | sonicwall | sma1000_firmware | - | - | - |