CVE-2016-5195 is a race condition vulnerability in Linux Kernel. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 March 2022, which means attackers have used it in real attacks. Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
What the vulnerability class means
A linux kernel race condition means two or more execution paths can compete over shared kernel state at the wrong moment. In this case, the flaw allowed a local user to win a timing window and elevate privileges, which makes it especially dangerous on multi-user systems and any host where low-privilege code can already run.
Race conditions are hard to reason about because the vulnerable behaviour may appear intermittent, and successful exploitation often depends on timing, workload, and system state. That unpredictability does not reduce the risk, it often increases it because defenders may miss weak signals until the issue is actively abused.
Why this vulnerability is dangerous in a kernel
The kernel sits at the core of process, memory, and permission enforcement, so a race condition there can convert limited local access into full system control. Even when the initial attacker foothold is only a standard account, privilege escalation can expose credentials, data, security tools, and the ability to tamper with logs or persistence mechanisms.
Because the flaw affects core memory handling, the security impact is broader than a single application bug. It can undermine the trust boundary between user space and the operating system, especially where containers, shared hosts, developer workstations, or exposed remote access paths make local execution easier to obtain.
How organisations assess exposure and reduce risk
Exposure assessment starts with knowing which systems run vulnerable kernel builds and whether any of them allow untrusted local code execution. Validate that against your asset inventory, kernel lifecycle records, vendor advisories, and the CISA KEV catalogue, which is the authoritative signal that this issue has been observed in real attacks.
When patching is delayed, organisations should narrow attacker opportunity by reducing local execution paths, tightening administrative access, and using compensating controls that limit privilege gain. Vulnerability management matters here because prioritisation should reflect exploitability, exposure, and the likelihood that an attacker can turn a local foothold into privilege escalation.
Detection and post-exploitation review
Detection is difficult because the race may leave little obvious evidence at the moment of success. Security teams should look for unusual privilege changes, suspicious process trees, unexpected root shells, and signs that a low-privilege account suddenly accessed protected files or administrative interfaces.
After patching, review whether the host was already compromised before remediation. NIST National Vulnerability Database and the CVE Program provide the canonical record for correlating exposure, while a compromise review should also check whether privileged sessions, SSH credentials, API tokens, or local service accounts were captured after escalation.
Risk and Threat Considerations
This kind of kernel flaw is attractive because it turns a limited foothold into a high-value one. In practical terms, an attacker who can run code locally may be able to race the kernel into granting elevated rights, then use that access for persistence, defense evasion, or lateral movement.
Failure mechanism: The kernel fails to keep shared state stable across concurrent operations, so a narrow timing window lets an unprivileged caller perform an action that should have remained blocked.
Impact: Successful exploitation can result in root-level control of the host, exposure of sensitive data, and compromise of the trust assumptions that other security controls rely on.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires exposure tracking, prioritisation, and remediation of exploitable kernel weakness. |
| Recommendation — Prioritise and remediate the affected kernel issue through continuous vulnerability management. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Privilege escalation can expose protected data once kernel control is gained. |
| Recommendation — Protect sensitive data so a kernel privilege escalation yields less usable information. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | A kernel race condition is a software flaw that requires tracked remediation and verification. |
| SI-4 — System Monitoring | Exploitation review depends on monitoring for unusual privilege changes and host compromise indicators. | |
| AC-6 — Least Privilege | Limiting local privilege reduces the blast radius of a successful race-condition exploit. | |
| Recommendation — Remediate the kernel flaw and verify that patched systems no longer accept the exploit path. Monitor hosts for privilege escalation indicators and post-exploitation activity. Apply least privilege to reduce what an attacker can do after local compromise. | ||
Practitioner Guidance
Why practitioners should care: Treat local privilege escalation issues as host compromise accelerators, not as ordinary bugs. Once an attacker can become root, many downstream controls become far easier to bypass.
What to watch for: Prioritise hosts that are internet-exposed, multi-tenant, or likely to run untrusted code, then confirm whether kernel patching has actually reached those systems rather than assuming platform updates are uniformly deployed.
Practitioner takeaway: For KEV-listed kernel race conditions, remediation should be paired with incident review, because a patched host may still need credential rotation and compromise verification.