A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
Four local root privilege escalation vulnerabilities in the Linux kernel, aged 10-21 years, disclosed as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469.
Researcher manizada disclosed four Linux kernel local root vulnerabilities on oss-security after the embargo agreed with linux-distros@ expired. The issues, dubbed DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469), were reported to security@kernel.org and relevant maintainers in mid-July 2026. The underlying bugs are stated to have existed for 10-21 years. Per the post, the first three LPEs require certain preconditions, though the announcement text is truncated before details.
- Four Linux kernel local privilege escalation flaws now publicly disclosed
- Bugs persisted 10-21 years before discovery and coordinated fix
- Reported mid-July to security@kernel.org and subsystem maintainers
- Disclosure followed agreed embargo expiry with linux-distros@
- First three LPEs require specific preconditions per the announcement
- Vendors
- Linux kernel
- Products
- Linux kernel
- Organizations
- oss-securitylinux-distros
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68121 | Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject) | 7.8 | <1% | PoC ×2 | |
| CVE-2026-74469 | Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit… | 8.8 | <1% | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation | — | <1% | PoC ×2 | |
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption | 7.8 | <1% | PoC ×2 |
From the original article
Posted by manizada on Sep 17 Hi folks, Emailing here now that the embargo agreed upon with linux-distros@ has expired. Flagging four local root vulnerabilities in the Linux kernel, originally reported to security () kernel org and the relevant maintainers in mid-July: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.