Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell
Four Linux kernel privilege escalation flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) allow local root access; fixes ship in stable kernel branches with PoC exploits published.
Researcher Asim Viladi Oglu Manizada reported four memory-corruption LPEs in long-standing Linux kernel networking code in mid-July: DirtyAH6 (CVE-2026-80844, IPv6 AH/XFRM), TUNderflow (CVE-2026-81000, TUN/TAP integer underflow), PPPoEject (CVE-2026-68121, PPPoE use-after-free), and DiagSpill (CVE-2026-74469, SCTP sock_diag overwrite of ~8 MB). Published proof-of-concept exploits demonstrate root shell access; the first three rely on unprivileged user namespaces, while DiagSpill does not. Patches are included in Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4, and AppArmor/SELinux did not block the tested exploit paths.
- Four memory-corruption LPEs in IPv6 AH, TUN/TAP, PPPoE, and SCTP code
- PoC exploits achieve root; first three rely on unprivileged user namespaces
- DiagSpill needs no namespaces or special capabilities when SCTP and sctp_diag are enabled
- AppArmor and SELinux did not block exploit paths in testing
- Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
- Vendors
- Linux Foundation
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68121 | Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject) | 7.8 | <1% | PoC ×2 | |
| CVE-2026-74469 | Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit… | 8.8 | <1% | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation | — | <1% | PoC ×2 | |
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption | 7.8 | <1% | PoC ×2 |
From the original article
3 min read at gbhackers.com
Linux administrators are being urged to patch four newly disclosed local privilege escalation (LPE) vulnerabilities, collectively known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. These vulnerabilities can allow attackers to corrupt kernel memory and gain root-level access on affected systems.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.