CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV; federal patch deadline September 21, 2026.
80
CVE-2026-80844
Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation
- CVSS
- —
- EPSS
- <1%p38
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Linux kernel's IPv6 Authentication Header implementation (net/ipv6/ah6, part of xfrm) fails to validate the segments_left field of an IPv6 routing header before rearranging addresses for ICV computation, so a crafted raw IPv6 (IP_HDRINCL) packet with hdrlen=2 but segments_left=255 drives pointer arithmetic and a memmove roughly 4,064 bytes out of bounds. A local attacker who can open raw sockets (e.g., holding CAP_NET_RAW, which is commonly granted in containers) can trigger this kernel memory corruption — publicly tracked under the name 'DirtyAH6' — and potentially escalate privileges to root. Any Linux system whose kernel includes IPv6 AH support (the ah6 module) is affected, which spans most mainstream distribution kernels on servers, cloud hosts, containers, and embedded devices. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.2% probability of exploitation within 30 days (9th percentile).
What to do: Update to a kernel containing the upstream xfrm/ah6 fix once your distribution ships it (no fixed version number appears in the source data, so follow distro advisories for CVE-2026-80844). As interim mitigations, blacklist or avoid loading the ah6 module if you do not use IPsec AH, and remove or restrict CAP_NET_RAW from containers and unprivileged users. Check exposure on hosts with 'lsmod | grep ah6' and audit container runtime capability grants for CAP_NET_RAW.
| Product | Affected |
|---|---|
| Linux kernel xfrm AH6 (net/ipv6/ah6.c) | — |
Estimated exposure
mass≈10^8–10^9 Linux systems ship the affected code path (kernel ubiquitous; ah6 compiled into most mainstream distro kernels), though only… — The Linux kernel runs on hundreds of millions to billions of servers, cloud instances, containers, and embedded devices, and mainstream distribution kernels typically build IPv6 AH (ah6) support, but actual exploitation requires local code…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
In the news
7 stories⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
Weekly recap led by actively exploited Cisco ISE auth-bypass CVE-2026-76460 (CVSS 10.0), plus Plugin4Shell AI-agent RCE and KREMLIN banking malware.
78
Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access
Four patched Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—let local attackers corrupt kernel memory and gain root privileges.
68
Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell
Four Linux kernel privilege escalation flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) allow local root access; fixes ship in stable kernel branches with PoC exploits published.
68
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
Researcher Asim Manizada published working exploits for four patched Linux kernel flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) enabling local root access.
65
A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
Four local root privilege escalation vulnerabilities in the Linux kernel, aged 10-21 years, disclosed as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469.
62
Linux kernel IPv6 AH routing header bug enables local privilege escalation
ZDI rates CVE-2026-80844 at CVSS 8.8; an attacker needs low-privileged code execution first.
48