Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell
Four Linux kernel privilege escalation flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) allow local root access; fixes ship in stable kernel branches with PoC exploits published.
Researcher Asim Viladi Oglu Manizada reported four memory-corruption LPEs in long-standing Linux kernel networking code in mid-July: DirtyAH6 (CVE-2026-80844, IPv6 AH/XFRM), TUNderflow (CVE-2026-81000, TUN/TAP integer underflow), PPPoEject (CVE-2026-68121, PPPoE use-after-free), and DiagSpill (CVE-2026-74469, SCTP sock_diag overwrite of ~8 MB). Published proof-of-concept exploits demonstrate root shell access; the first three rely on unprivileged user namespaces, while DiagSpill does not. Patches are included in Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4, and AppArmor/SELinux did not block the tested exploit paths.
- Four memory-corruption LPEs in IPv6 AH, TUN/TAP, PPPoE, and SCTP code
- PoC exploits achieve root; first three rely on unprivileged user namespaces
- DiagSpill needs no namespaces or special capabilities when SCTP and sctp_diag are enabled
- AppArmor and SELinux did not block exploit paths in testing
- Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-68121 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head. NVD description · AI analysis pending | 7.8 | <1% | — | — | ||
| CVE-2026-74469 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit. NVD description · AI analysis pending | 8.8 | <1% | — | — | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation The Linux kernel's IPv6 Authentication Header implementation (net/ipv6/ah6, part of xfrm) fails to validate the segments_left field of an IPv6 routing header before rearranging addresses for ICV computation, so a crafted raw IPv6 (IP_HDRINCL) packet with hdrlen=2 but segments_left=255 drives pointer arithmetic and a memmove roughly 4,064 bytes out of bounds. A local attacker who can open raw sockets (e.g., holding CAP_NET_RAW, which is commonly granted in containers) can trigger this kernel memory corruption — publicly tracked under the name 'DirtyAH6' — and potentially escalate privileges to root. Any Linux system whose kernel includes IPv6 AH support (the ah6 module) is affected, which spans most mainstream distribution kernels on servers, cloud hosts, containers, and embedded devices. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.2% probability of exploitation within 30 days (9th percentile). Do: Update to a kernel containing the upstream xfrm/ah6 fix once your distribution ships it (no fixed version number appears in the source data, so follow distro advisories for CVE-2026-80844). As interim mitigations, blacklist or avoid loading the ah6 module if you do not use IPsec AH, and remove or restrict CAP_NET_RAW from containers and unprivileged users. Check exposure on hosts with 'lsmod | grep ah6' and audit container runtime capability grants for CAP_NET_RAW. | — | <1% |
| mass≈10^8–10^9 Linux systems ship the affected code path (kernel ubiquitous; ah6 compiled into most mainstream distro kernels), though only… | ||
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption An integer underflow in the Linux kernel's TUN/TAP driver (net/tun.c) lets tun_get_user() compute a negative linear data size when the configured headroom (tun->align) exceeds the one-page skb-head budget; the value wraps when stored as a size_t, so tun_alloc_skb() can place skb->data outside the allocated buffer. The oversized headroom can be set locally or propagated to a TUN/TAP port by Open vSwitch when packets arrive from another port, so triggering requires injecting packets into a TUN/TAP device with a large alignment value, which needs local access with privileges. Successful exploitation corrupts kernel memory adjacent to the skb, giving a local attacker full confidentiality, integrity, and availability impact (CVSS 7.8), i.e., potential ring-0 code execution and complete host compromise. Any system running a kernel with the vulnerable tun_get_user() logic is affected, with VPN gateways, container hosts, and Open vSwitch/SDN deployments the most likely exposure paths. No public PoC is known, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported. Do: Apply a kernel update containing the upstream fix commit "net: tun: bound receive headroom" as soon as your distribution or vendor backports it. In the interim, restrict access to /dev/net/tun and CAP_NET_ADMIN for untrusted local users and containers, and review Open vSwitch bridges that forward traffic from ports with large headroom requirements into TUN/TAP ports. Monitor kernel logs for OOPS or BUG output in the tun_get_user/tun_alloc_skb paths as a sign of attempted abuse. | 7.8 | — |
| mass≈hundreds of millions of devices run kernels containing the affected driver; millions of hosts actively use TUN/TAP (VPN gateways, container networking, Open… |
Full article591 words · extracted from gbhackers.com · click to collapse
Linux administrators are being urged to patch four newly disclosed local privilege escalation (LPE) vulnerabilities, collectively known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. These vulnerabilities can allow attackers to corrupt kernel memory and gain root-level access on affected systems.
The vulnerabilities are tracked under the following CVE identifiers: CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. They affect long-standing network code in the Linux kernel.
Researcher Asim Viladi Oglu Manizada reported the issues to the Linux kernel security team in mid-July, and fixes have since been included in supported stable kernel branches.
Linux Kernel Hit by 4 LPE Flaws
- DirtyAH6 (CVE-2026-80844): This vulnerability affects the handling of the IPv6 Authentication Header in Linux’s XFRM/IPsec implementation. An incorrectly validated routing header field can lead to an out-of-bounds memory operation. Although the demonstrated local exploit requires unprivileged user namespaces, the underlying issue can also result in a remote denial-of-service condition on systems acting as IPv6 routers or gateways that utilize AH in transport mode. The researcher indicated that remote code execution was achieved in a controlled lab environment with memory manipulation. However, such exploitation is deemed highly difficult.
- TUNderflow (CVE-2026-81000): This is an integer-underflow vulnerability within the TUN/TAP virtual networking subsystem. A specially crafted network device path can propagate excessive receive headroom values to a raw TUN device, causing calculations for socket buffer allocation to wrap. As a result, packet handling may read or write outside allocated kernel memory.
- PPPoEject (CVE-2026-68121): This vulnerability exists in the processing of PPP over Ethernet. It arises from `pppoe_sendmsg()` retaining a pointer in a socket buffer after a lower-level device callback has reallocated and freed that buffer’s memory. Subsequent writes through this stale pointer can create a use-after-free condition, which may be exploited for local root escalation.
- DiagSpill (CVE-2026-74469): This flaw impacts SCTP diagnostic reporting through `sock_diag`. An SCTP association can have up to 65,536 peer transports, but the corresponding counter is only 16 bits wide. When the count wraps to zero, the kernel allocates insufficient Netlink response space before copying peer transport data, leading to an overwrite of approximately 8 MB.
All four vulnerabilities are memory corruption issues, and exploit reliability depends on the target system’s memory layout and grooming. However, proof-of-concept exploits published by the researcher demonstrate the ability to gain root shell access under certain configurations.
The first three vulnerabilities typically rely on unprivileged user namespaces, a feature generally accessible to regular local users and containers. DiagSpill is considered more serious from an access control perspective, as it does not require unprivileged user namespaces or special Linux capabilities when SCTP and `sctp_diag` support are available.
Mandatory access control technologies, such as AppArmor and SELinux, did not block the reported exploit paths during the researcher’s testing.
Organizations should upgrade to a kernel version that includes patches for all four vulnerabilities. The first stable versions that fully address these issues are Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.
If immediate patching is not feasible, administrators can reduce exposure by turning off unprivileged user namespaces. However, this will not mitigate risks from DiagSpill or threats stemming from already privileged containers.
Turning off unused functionalities such as AH6, TUN/TAP, PPPoE, SCTP, and `sctp_diag` can provide additional defense-in-depth; however, applying vendor kernel updates remains the recommended method of mitigation.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/linux-kernel-hit-by-4-lpe-flaws/