Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Accessnew
Four patched Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—let local attackers corrupt kernel memory and gain root privileges.
Researchers disclosed four Linux kernel privilege escalation vulnerabilities in long-standing networking code: DirtyAH6 (CVE-2026-80844) in IPv6 Authentication Header/XFRM processing, TUNderflow (CVE-2026-81000) in the TUN/TAP subsystem, PPPoEject (CVE-2026-68121), a use-after-free in PPP over Ethernet's pppoe_sendmsg(), and DiagSpill (CVE-2026-74469) in SCTP sock_diag reporting caused by a wrapping 16-bit transport counter. Most are local privilege escalation bugs, though IPv6 routers using AH transport mode face narrow remote denial-of-service risk, and one researcher demonstrated remote root access in a lab via memory grooming. Researcher Asim Viladi Oglu Manizada reported the issues to the kernel security team in mid-July, and coordinated patches are now available in stable branches including 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Restricting unprivileged user namespaces helps for three flaws but does not mitigate DiagSpill.