Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access
Four patched Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—let local attackers corrupt kernel memory and gain root privileges.
Researchers disclosed four Linux kernel privilege escalation vulnerabilities in long-standing networking code: DirtyAH6 (CVE-2026-80844) in IPv6 Authentication Header/XFRM processing, TUNderflow (CVE-2026-81000) in the TUN/TAP subsystem, PPPoEject (CVE-2026-68121), a use-after-free in PPP over Ethernet's pppoe_sendmsg(), and DiagSpill (CVE-2026-74469) in SCTP sock_diag reporting caused by a wrapping 16-bit transport counter. Most are local privilege escalation bugs, though IPv6 routers using AH transport mode face narrow remote denial-of-service risk, and one researcher demonstrated remote root access in a lab via memory grooming. Researcher Asim Viladi Oglu Manizada reported the issues to the kernel security team in mid-July, and coordinated patches are now available in stable branches including 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Restricting unprivileged user namespaces helps for three flaws but does not mitigate DiagSpill.
- DirtyAH6 (CVE-2026-80844): unvalidated IPv6 AH segments_left causes out-of-bounds access in IPsec/XFRM
- TUNderflow (CVE-2026-81000): integer underflow in TUN/TAP receive-headroom enables out-of-bounds reads and writes
- PPPoEject (CVE-2026-68121): use-after-free in pppoe_sendmsg() corrupts freed kernel memory
- DiagSpill (CVE-2026-74469): 16-bit SCTP transport counter wraps, overflowing Netlink diagnostic buffers
- Fixes shipped in stable kernels from 5.10.270 through 7.2.4; disabling user namespaces does not fix DiagSpill
- Vendors
- Linux
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68121 | Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject) | 7.8 | <1% | PoC ×2 | |
| CVE-2026-74469 | Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit… | 8.8 | <1% | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation | — | <1% | PoC ×2 | |
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption | 7.8 | <1% | PoC ×2 |
From the original article
2 min read at cybersecuritynews.com
Four newly disclosed Linux kernel vulnerabilities could allow local attackers to corrupt kernel memory and escalate privileges to root on affected systems. The flaws, named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affect long-standing networking code and have now received upstream fixes. The vulnerabilities are tracked as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.