Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
Researcher Asim Manizada published working exploits for four patched Linux kernel flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) enabling local root access.
Security researcher Asim Manizada released a write-up with working exploit code for four Linux kernel memory-safety bugs allowing local privilege escalation to root: DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP). The bugs, aged 10-21 years, were found via an AI-assisted memory-layout analysis process and reported to the kernel security team in mid-July; fixes shipped in stable kernels 5.10.270 through 7.2.4. Three flaws require unprivileged user namespaces while DiagSpill needs only the SCTP module; DirtyAH6 and DiagSpill can cause remote crashes in narrow configurations, and no real-world exploitation has been reported.
- Four Linux kernel LPE exploits made public; patches in kernels 5.10.270-7.2.4
- Three flaws require unprivileged user namespaces; DiagSpill needs only SCTP module
- All are memory-safety bugs enabling kernel memory corruption to root
- DirtyAH6 and DiagSpill can remotely crash hosts in narrow configurations
- Researcher used AI-assisted analysis; no in-the-wild attacks reported
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1611 Escape to HostT1498 Network Denial of Service
- Vendors
- Linux kernelOpen vSwitch
- Products
- Linux kernelOpen vSwitch
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68121 | Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject) | 7.8 | <1% | PoC ×2 | |
| CVE-2026-74469 | Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit… | 8.8 | <1% | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation | — | <1% | PoC ×2 | |
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption | 7.8 | <1% | PoC ×2 |
From the original article
5 min read at thehackernews.com
A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access on a machine. Kernel maintainers have fixed all four over the past few weeks, so a system running an up-to-date kernel is not affected. But the exploit code is now public, and any machine still running an older kernel should be updated.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.