Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
Researcher Asim Manizada published working exploits for four patched Linux kernel flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) enabling local root access.
Security researcher Asim Manizada released a write-up with working exploit code for four Linux kernel memory-safety bugs allowing local privilege escalation to root: DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP). The bugs, aged 10-21 years, were found via an AI-assisted memory-layout analysis process and reported to the kernel security team in mid-July; fixes shipped in stable kernels 5.10.270 through 7.2.4. Three flaws require unprivileged user namespaces while DiagSpill needs only the SCTP module; DirtyAH6 and DiagSpill can cause remote crashes in narrow configurations, and no real-world exploitation has been reported.
- Four Linux kernel LPE exploits made public; patches in kernels 5.10.270-7.2.4
- Three flaws require unprivileged user namespaces; DiagSpill needs only SCTP module
- All are memory-safety bugs enabling kernel memory corruption to root
- DirtyAH6 and DiagSpill can remotely crash hosts in narrow configurations
- Researcher used AI-assisted analysis; no in-the-wild attacks reported
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-68121 | Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject) CVE-2026-68121 is a use-after-free in the Linux kernel's PPPoE implementation: pppoe_sendmsg() caches a pointer to the PPPoE header before calling dev_hard_header(), but device header callbacks are allowed to reallocate the socket buffer head, leaving that pointer dangling. The race is triggered when a send blocks in copy_from_user() while the first non-Ethernet port is added to an empty team device, causing the team's delegated GRE header callback to expand the skb head; PPPoE then writes six bytes through the stale pointer into freed memory. A local attacker can leverage this memory corruption for privilege escalation, reportedly reaching a root shell as one of four recently disclosed Linux kernel LPE flaws dubbed 'PPPoEject'. Any Linux system with PPPoE support enabled is potentially affected, though practical exploitation requires local code execution plus the uncommon combination of a PPPoE socket and a team device. A public proof-of-concept has been published on GitHub, but the flaw is not in CISA's KEV catalog and EPSS remains low at 0.1%. Do: Update to the latest stable or vendor-supplied kernel that includes the upstream fix ('pppoe: reload header pointer after dev_hard_header()') as soon as your distribution backports it. Until patched, restrict local untrusted code execution on PPPoE-connected hosts and avoid combining PPPoE interfaces with team bonding devices or adding non-Ethernet ports to team devices on such hosts. Verify with your kernel vendor whether your running kernel contains the corrected pppoe_sendmsg() and watch distribution security advisories for the backport. | 7.8 | <1% | PoC |
| massHundreds of millions of Linux installations ship the vulnerable PPPoE code (enabled by default in mainstream distributions), though PPPoE-plus-team-device… | |
| CVE-2026-74469 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit. NVD description · AI analysis pending | 8.8 | <1% | — | — | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation The Linux kernel's IPv6 Authentication Header implementation (net/ipv6/ah6, part of xfrm) fails to validate the segments_left field of an IPv6 routing header before rearranging addresses for ICV computation, so a crafted raw IPv6 (IP_HDRINCL) packet with hdrlen=2 but segments_left=255 drives pointer arithmetic and a memmove roughly 4,064 bytes out of bounds. A local attacker who can open raw sockets (e.g., holding CAP_NET_RAW, which is commonly granted in containers) can trigger this kernel memory corruption — publicly tracked under the name 'DirtyAH6' — and potentially escalate privileges to root. Any Linux system whose kernel includes IPv6 AH support (the ah6 module) is affected, which spans most mainstream distribution kernels on servers, cloud hosts, containers, and embedded devices. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.2% probability of exploitation within 30 days (9th percentile). Do: Update to a kernel containing the upstream xfrm/ah6 fix once your distribution ships it (no fixed version number appears in the source data, so follow distro advisories for CVE-2026-80844). As interim mitigations, blacklist or avoid loading the ah6 module if you do not use IPsec AH, and remove or restrict CAP_NET_RAW from containers and unprivileged users. Check exposure on hosts with 'lsmod | grep ah6' and audit container runtime capability grants for CAP_NET_RAW. | — | <1% | PoC |
| mass≈10^8–10^9 Linux systems ship the affected code path (kernel ubiquitous; ah6 compiled into most mainstream distro kernels), though only… | |
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption An integer underflow in the Linux kernel's TUN/TAP driver (net/tun.c) lets tun_get_user() compute a negative linear data size when the configured headroom (tun->align) exceeds the one-page skb-head budget; the value wraps when stored as a size_t, so tun_alloc_skb() can place skb->data outside the allocated buffer. The oversized headroom can be set locally or propagated to a TUN/TAP port by Open vSwitch when packets arrive from another port, so triggering requires injecting packets into a TUN/TAP device with a large alignment value, which needs local access with privileges. Successful exploitation corrupts kernel memory adjacent to the skb, giving a local attacker full confidentiality, integrity, and availability impact (CVSS 7.8), i.e., potential ring-0 code execution and complete host compromise. Any system running a kernel with the vulnerable tun_get_user() logic is affected, with VPN gateways, container hosts, and Open vSwitch/SDN deployments the most likely exposure paths. No public PoC is known, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported. Do: Apply a kernel update containing the upstream fix commit "net: tun: bound receive headroom" as soon as your distribution or vendor backports it. In the interim, restrict access to /dev/net/tun and CAP_NET_ADMIN for untrusted local users and containers, and review Open vSwitch bridges that forward traffic from ports with large headroom requirements into TUN/TAP ports. Monitor kernel logs for OOPS or BUG output in the tun_get_user/tun_alloc_skb paths as a sign of attempted abuse. | 7.8 | <1% | PoC |
| mass≈hundreds of millions of devices run kernels containing the affected driver; millions of hosts actively use TUN/TAP (VPN gateways, container networking, Open… |
Full article1,046 words · extracted from thehackernews.com · click to collapse
A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access on a machine.
Kernel maintainers have fixed all four over the past few weeks, so a system running an up-to-date kernel is not affected. But the exploit code is now public, and any machine still running an older kernel should be updated.
The flaws are called DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. Researcher Asim Manizada found them and reported them to the Linux kernel security team in mid-July.
He published a technical write-up with working exploits on September 18, after a coordinated hold with Linux distributions so the fixes could be released first.
So far, there are no reports of the four being used in real-world attacks. The exploits are Manizada's own, are tuned to specific kernel builds, and can crash a machine, so they are meant for isolated test systems.
Still, public exploit code raises the risk on shared systems. Local privilege escalation matters most where an attacker already has some access, such as a low-privileged account on a multi-user server, and wants to take full control.
What's Affected
Three of the four flaws can be reached by an ordinary user only when unprivileged user namespaces are enabled. User namespaces are a Linux feature that lets a normal user act as root inside a private sandbox. Many distributions enable them by default, which is how an attacker gains the network privileges the exploits require.
The fourth flaw, DiagSpill, is the exception. It requires no user namespaces or special privileges, as long as the system has the SCTP networking module available.
| Flaw | CVE | Kernel area | Local prerequisite | Reachable remotely? |
|---|---|---|---|---|
| DirtyAH6 | CVE-2026-80844 | IPsec AH6 (IPv6) | Unprivileged user namespaces | Crash only, and only if the host routes IPv6 and adds an Authentication Header in transport mode |
| TUNderflow | CVE-2026-81000 | TUN/TAP virtual network devices | Unprivileged user namespaces | No |
| PPPoEject | CVE-2026-68121 | PPPoE | Unprivileged user namespaces | No |
| DiagSpill | CVE-2026-74469 | SCTP (sctp_diag) | None | Crash only, and only with non-default SCTP options turned on |
Manizada also found that two of the flaws, DirtyAH6 and DiagSpill, can be triggered over the network, but only in narrow cases and mainly to cause the system to crash.
DirtyAH6 can crash a host that acts as an IPv6 router or gateway and adds an IPsec Authentication Header in transport mode. DiagSpill can crash a host only when certain SCTP options, which are off by default, are switched on.
Manizada reached remote root with DirtyAH6 only in his own lab, and only by shaping memory on the target first. Doing that from a remote position alone, he wrote, "looks extremely difficult," though he did not rule it out. For DiagSpill, he said he sees no path to remote root at all, even with perfect memory shaping.
He also said the flaws could, in theory, allow an attacker to escape a container, but he did not build one.
What To Do
Update to a kernel that carries all four fixes. The first stable kernel releases with the complete set are:
- 5.10.270
- 5.15.221
- 6.1.188
- 6.6.157
- 6.12.109
- 6.18.50
- 7.2.4
These are the version numbers from the main Linux kernel project. Most people run a kernel from a distribution instead, such as Debian, Ubuntu, Red Hat, or SUSE, which uses its own version numbers and adds these fixes on its own schedule. Check your distribution's security advisory to confirm it has shipped an update that includes all four, rather than matching the numbers above.
If you cannot patch right away, two steps reduce the risk:
- Turn off unprivileged user namespaces. This closes the ordinary-user path to DirtyAH6, TUNderflow, and PPPoEject. It does not stop DiagSpill, and it does not stop a container or process that already has network-admin privileges.
- Turn off the affected features if you do not use them: AH6, TUN/TAP, PPPoE, and SCTP.
Manizada recommends patching rather than turning off features, because other paths to the same flaws may exist.
How the Bugs Work
All four are memory-safety bugs in different parts of the kernel's networking code. Each one allows an attacker to corrupt kernel memory, which Manizada then used to gain a root shell. The underlying mistakes are old, ranging from 10 to 21 years.
- DirtyAH6 is in the IPsec code that handles the IPv6 Authentication Header. The code trusted a routing-header field without verifying it against the number of addresses present, so a crafted packet caused an internal pointer to move far out of bounds and write past the buffer.
- TUNderflow is in the TUN and TAP virtual network devices. A single value was used both as spare space and as a size, and an oversized value passed in through Open vSwitch caused the size calculation to wrap around, so packet data landed outside its buffer.
- PPPoEject is in the code for PPP over Ethernet. It kept a pointer into a network buffer while calling a device routine that could free and move that buffer, and the later writes then used freed memory, a bug known as a use-after-free.
- DiagSpill is in the reporting code for SCTP. A counter that tracks connection endpoints is only 16 bits wide, so the 65,536th endpoint wrapped it back to zero. The reporting code then set aside no space but copied the full list, writing about 8 MiB of data past the end of its buffer.
An AI-Assisted Run
Manizada said he found the four flaws with an AI-assisted process that builds a map of how the kernel handles memory and reasons about its layout. The kernel's fix for DirtyAH6 records this: the commit includes an "Assisted-by" line that credits his custom AI tooling.
This is the latest in a run of Linux kernel privilege escalation flaws disclosed through 2026, several of them found with help from large language models. Manizada disclosed a similar Open vSwitch flaw, OVSwrap, in July.
One of the new exploits also reuses a technique from Dirty Frag, another Linux kernel root flaw disclosed in May by a different researcher. In his write-up, Manizada said this batch likely ends the public phase of his AI-assisted bug hunting.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/public-exploits-released-for-four-linux.html