Researcher Asim Manizada published working exploits for four patched Linux kernel flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) enabling local root access.
Security researcher Asim Manizada released a write-up with working exploit code for four Linux kernel memory-safety bugs allowing local privilege escalation to root: DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP). The bugs, aged 10-21 years, were found via an AI-assisted memory-layout analysis process and reported to the kernel security team in mid-July; fixes shipped in stable kernels 5.10.270 through 7.2.4. Three flaws require unprivileged user namespaces while DiagSpill needs only the SCTP module; DirtyAH6 and DiagSpill can cause remote crashes in narrow configurations, and no real-world exploitation has been reported.
Doyensec details CVE-2026-90049 in Open vSwitch, enabling deterministic Linux kernel local privilege escalation on default major distribution installs.
Doyensec reports that the Open vSwitch datapath strips the SKBFL_SHARED_FRAG flag from packets it is still forwarding, allowing an in-place decrypt to write attacker-chosen bytes into root-owned page cache — a Dirty COW-class primitive that re-opens the Fragnesia bug family. The issues are tracked as CVE-2026-90049, CVE-2026-89487, and CVE-2026-80977, and were reported to the kernel security team with fixes coordinated alongside OVS maintainers. A deterministic local privilege escalation works on default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL where unprivileged user namespaces and openvswitch auto-loading are enabled; the fix landed in mainline and shipped in stable on 09/04/2026. The write technique builds on the earlier Fragnesia and Dirty Frag bugs, including CVE-2026-43284 and CVE-2026-43500.
Linux kernel skb_zerocopy() error-path flaw risks UAF/memory corruption via Open vSwitch
The Linux kernel's skb_zerocopy() helper destructively calls skb_tx_error() on the source socket buffer when skb_orphan_frags() fails, completing the source skb's zerocopy uarg and clearing the SKBFL_SHARED_FRAG page-ownership flag on a buffer the helper does not own. On the Open vSwitch OVS_ACTION_ATTR_USERSPACE path the skb is not freed after this error - do_execute_actions() ignores output_userspace()'s return value and keeps forwarding the same skb - so zerocopy buffers can be signaled as free while still in flight, and because SKBFL_SHARED_FRAG is cleared, esp_input() can decrypt in place over page fragments the skb does not privately own. A local attacker able to push traffic through an affected Open vSwitch datapath or an nfnetlink_queue (NFQUEUE) flow and trigger a frag-orphaning failure can cause use-after-free conditions and kernel memory/data corruption, with kernel-level confidentiality, integrity and availability impact (CVSS 9.3, local vector, scope changed). Any Linux system with the pre-fix kernel code is affected, with realistic trigger exposure on hosts running the Open vSwitch kernel datapath or NFQUEUE userspace queuing; the source data provides no specific vulnerable or fixed version numbers. No exploitation is known, no public proof-of-concept exists, and the issue is not listed in CISA KEV.
· Linux kernel (net/skbuff skb_zerocopy(), reachable via Open vSwitch kernel datapath and nfnetlink_queue)mass
In the Linux kernel, the following vulnerability has been resolved:
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX.…
Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123)
CVE-2026-43284 is a write-what-where memory-safety flaw (CWE-123) in the Linux kernel's xfrm/ESP (IPsec) code: the IPv4/IPv6 UDP datagram send paths fail to mark pages spliced into a UDP skb with SKBFL_SHARED_FRAG when MSG_SPLICE_PAGES attaches pipe pages, so the ESP input path wrongly treats the packet as privately owned and decrypts it in place over memory the skb does not exclusively own. It is triggered when locally generated UDP traffic built from spliced pipe pages is processed by the ESP decryption path, typically in IPsec NAT-traversal (ESP-in-UDP, UDP port 4500) configurations; the in-place decrypt can corrupt or expose data still referenced by the pipe or other owners of those shared pages. A local, low-privileged attacker can thereby cause high-severity confidentiality, integrity, and availability impact that extends beyond the packet itself (CVSS 3.1: 8.8, scope changed); no remote or unauthenticated trigger is described. Any Linux system running a kernel with the vulnerable UDP splice and ESP-in-UDP paths is affected, most importantly IPsec VPN gateways and clients; the advisory lists no affected version ranges. No public proof-of-concept or confirmed in-the-wild exploitation is known (not on CISA KEV), but EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), so patching should not be deferred.
Linux kernel TUN/TAP headroom integer underflow enables local memory corruption
An integer underflow in the Linux kernel's TUN/TAP driver (net/tun.c) lets tun_get_user() compute a negative linear data size when the configured headroom (tun->align) exceeds the one-page skb-head budget; the value wraps when stored as a size_t, so tun_alloc_skb() can place skb->data outside the allocated buffer. The oversized headroom can be set locally or propagated to a TUN/TAP port by Open vSwitch when packets arrive from another port, so triggering requires injecting packets into a TUN/TAP device with a large alignment value, which needs local access with privileges. Successful exploitation corrupts kernel memory adjacent to the skb, giving a local attacker full confidentiality, integrity, and availability impact (CVSS 7.8), i.e., potential ring-0 code execution and complete host compromise. Any system running a kernel with the vulnerable tun_get_user() logic is affected, with VPN gateways, container hosts, and Open vSwitch/SDN deployments the most likely exposure paths. No public PoC is known, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported.
· Linux kernel (net/tun.c TUN/TAP driver) PoC mass
Shared zerocopy state corruption in Linux kernel via Open vSwitch recirculation clones
A flaw in the Linux kernel networking stack allows skb_tx_error() to modify zerocopy state held in skb_shinfo(), which is shared with every clone, so a cloned skb can prematurely tell the zerocopy producer its pages are free and drop SKBFL_SHARED_FRAG while the original packet is still in flight. The bug is reachable through Open vSwitch when a non-last OVS_ACTION_ATTR_RECIRC action feeds an skb_clone() into ovs_dp_process_packet() while do_execute_actions() keeps forwarding the original; a flow miss on the clone strips the zerocopy markers from the still-in-flight packet. A later local ESP (IPsec) delivery then decrypts in place over fragments it does not privately own, causing kernel memory corruption with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8; local attack vector, low privileges required, no user interaction). Practical exposure is limited to hosts running the OVS kernel datapath with recirculation actions combined with zerocopy transmit and local ESP delivery, not generic Linux systems. No public PoC exists, the issue is not in CISA's KEV, and no exploitation has been reported.
Linux kernel Open vSwitch error-path bug enables local page-cache writes
The Linux kernel's Open vSwitch module mishandles failures of the USERSPACE action: queue_userspace_packet()'s error path calls skb_tx_error() on an skb it has only borrowed (not dropped), stripping the SKBFL_SHARED_FRAG zerocopy flag from a packet that do_execute_actions() keeps forwarding through the rest of the flow's actions. On a MSG_ZEROCOPY packet carrying page-cache fragments, that flag is what forces the ESP input path (esp_input()) to copy the data before decrypting in place; once stripped, a locally delivered ESP-in-UDP packet decrypts in place over shared page-cache pages the sender does not own, giving an unprivileged local user a page-cache write primitive (the 'Fragnesia' technique). Successful exploitation gives an attacker high confidentiality, integrity, and availability impact — for example, tampering with page-cache-backed file contents to escalate privileges (CVSS 3.1: 7.8, local attack vector, low privileges required). Affected products are Linux kernels containing the openvswitch module, with the flawed error path present since commit 36d5fe6a0007 (2018) but only becoming exploitable once esp_input() began relying on SKBFL_SHARED_FRAG to gate in-place decryption. No public proof-of-concept is known and the flaw is not on CISA's KEV; exploitation requires local code execution plus specific OVS, zerocopy, and ESP-in-UDP conditions.
Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject)
CVE-2026-68121 is a use-after-free in the Linux kernel's PPPoE implementation: pppoe_sendmsg() caches a pointer to the PPPoE header before calling dev_hard_header(), but device header callbacks are allowed to reallocate the socket buffer head, leaving that pointer dangling. The race is triggered when a send blocks in copy_from_user() while the first non-Ethernet port is added to an empty team device, causing the team's delegated GRE header callback to expand the skb head; PPPoE then writes six bytes through the stale pointer into freed memory. A local attacker can leverage this memory corruption for privilege escalation, reportedly reaching a root shell as one of four recently disclosed Linux kernel LPE flaws dubbed 'PPPoEject'. Any Linux system with PPPoE support enabled is potentially affected, though practical exploitation requires local code execution plus the uncommon combination of a PPPoE socket and a team device. A public proof-of-concept has been published on GitHub, but the flaw is not in CISA's KEV catalog and EPSS remains low at 0.1%.
· Linux kernel (PPPoE subsystem, pppoe_sendmsg()) PoC mass
Out-of-bounds write in Linux kernel AF_RXRPC decryption enables root access
CVE-2026-43500 is a memory-corruption flaw in the Linux kernel's AF_RXRPC (rxrpc) subsystem: the DATA and RESPONSE packet handlers only copy received skbs to a linear buffer before decryption when the skb is marked cloned, so non-cloned skbs that still carry externally owned paged fragments (SKBFL_SHARED_FRAG, e.g. set by splice() into a UDP socket, or skbs with a frag_list) fall through to the in-place decryption path. In that path the shared fragment pages are bound directly into the AEAD/skcipher scatter-gather list via skb_to_sgvec(), so decryption writes into pages shared with other kernel or user contexts, causing out-of-bounds/write-what-where corruption (CWE-787/CWE-123), notably via the splice-into-UDP-socket loopback vector. A local low-privileged attacker who can get the machine to process such rxrpc packets can corrupt kernel memory and escalate to root (CVSS 3.1: 7.8 high, local vector, high confidentiality/integrity/availability impact). Affected systems are Linux kernels with the AF_RXRPC subsystem available — the transport used by the AFS/kAFS network filesystem — which mainstream distribution kernels ship as a module or built-in; no specific affected or fixed version ranges are provided in the data. It is not on CISA's KEV list and the CVE record lists no public PoC, but news reports describe a 'Dirty Frag' local privilege-escalation exploit giving root across major distributions and a released PoC, and EPSS puts the 30-day exploitation probability at about 93% (100th percentile).
Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation
The Linux kernel's IPv6 Authentication Header implementation (net/ipv6/ah6, part of xfrm) fails to validate the segments_left field of an IPv6 routing header before rearranging addresses for ICV computation, so a crafted raw IPv6 (IP_HDRINCL) packet with hdrlen=2 but segments_left=255 drives pointer arithmetic and a memmove roughly 4,064 bytes out of bounds. A local attacker who can open raw sockets (e.g., holding CAP_NET_RAW, which is commonly granted in containers) can trigger this kernel memory corruption — publicly tracked under the name 'DirtyAH6' — and potentially escalate privileges to root. Any Linux system whose kernel includes IPv6 AH support (the ah6 module) is affected, which spans most mainstream distribution kernels on servers, cloud hosts, containers, and embedded devices. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.2% probability of exploitation within 30 days (9th percentile).
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.