Linux kernel security wave: public exploits for four local-root flaws (DirtyAH6, PPPoEject, TUNderflow, DiagSpill) and CISA KEV listing of three actively exploited bugs drive… · ZeroHour
Linux kernel security wave: public exploits for four local-root flaws (DirtyAH6, PPPoEject, TUNderflow, DiagSpill) and CISA KEV listing of three actively exploited bugs drive…
What's new: First merged summary for this story. On September 18, 2026, researcher Asim Manizada's public exploits for four Linux kernel local-root flaws (DirtyAH6, PPPoEject, TUNderflow, DiagSpill) drew oss-security discussion, including Gentoo's inability to ship split-subpackage kernel fixes for binary installs. The same day, CISA added three different, actively exploited kernel flaws (CVE-2025-39682,…
Merged summary · glm-5.3 · rewritten as coverage arrives
Researcher Asim Manizada released working exploits for four Linux kernel local privilege escalation flaws fixed in stable kernels 5.10.270–7.2.4, while CISA separately added three actively exploited kernel bugs (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)…
Two distinct clusters of Linux kernel vulnerabilities dominated the September 18–21, 2026 reporting window. First, on September 18, security researcher Asim Manizada published a write-up with working exploit code for four Linux kernel memory-safety bugs enabling local privilege escalation to root: DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP). The bugs, aged 10–21 years, were found via an AI-assisted memory-layout analysis process, reported to the kernel security team in mid-July, and fixed in stable kernels 5.10.270 through 7.2.4. Three of the flaws require unprivileged user namespaces, while DiagSpill needs only the SCTP module; DirtyAH6 and DiagSpill can cause remote crashes in narrow configurations. No real-world exploitation has been reported for these four. An oss-security thread praised the advisory for listing fix commits, affected stable versions, exploitation prerequisites, and affected subsystems, but flagged distribution patching obstacles: Gentoo's package manager cannot implement split subpackages, leaving gentoo-kernel-bin and binary package installs without a way to receive fixed kernels; commenters also indicated more LPE disclosures appear to be coming.
Second, on the same day, CISA added three different Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation: CVE-2025-39682 (CVSS 9.8, improper condition check in the kernel TLS receive path allowing zero-length records to bypass recvmsg() type handling, enabling denial of service or memory disclosure), CVE-2026-53266 (CVSS 8.8, out-of-bounds write in the netfilter bridge ebtables SNAT ARP-rewriting path, triggerable by a crafted ARP packet, enabling memory corruption, crashes, or privilege escalation), and CVE-2025-39964 (CVSS 7.8, race condition in AF_ALG sockets allowing concurrent sendmsg() writes to corrupt crypto socket state, causing crashes or altered cryptographic results). Federal civilian agencies were required to remediate by September 21, 2026, and to perform forensic triage for evidence of compromise. Sources disagree on two points: the governing directive is cited as BOD 26-04 by Cyber Security News but BOD 22-01 by Security Affairs, and CVE-2025-39682 is described as remotely triggerable on internet-accessible kTLS services by Cyber Security News while Security Affairs frames it as affecting authenticated…
oss-security follow-up on four Linux kernel local root vulnerabilities — DirtyAH6, PPPoEject, TUNderflow, DiagSpill — praising the advisory's disclosure quality.
ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is…
Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS
Four Linux kernel LPE flaws with public working exploits, disclosed by researcher Asim Manizada: DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP), PPPoEject (CVE-2026-68121, PPPoE), DiagSpill (CVE-2026-74469,…
The quartet's bugs are 10–21 years old, were found via AI-assisted memory-layout analysis, were reported to the kernel security team in mid-July 2026, and were fixed in stable kernels 5.10.270 through 7.2.4.
Exploitation prerequisites: three of the quartet flaws require unprivileged user namespaces; DiagSpill requires only the SCTP module. DirtyAH6 and DiagSpill can cause remote crashes in narrow configurations; no in-the-wild exploitation…
Gentoo's package manager cannot implement split subpackages for gentoo-kernel-bin, leaving binary package installs without fixed kernels, per the oss-security thread; the advisory was praised for including fix commits, affected versions,…
CISA added three separate, actively exploited Linux kernel flaws to KEV on September 18, 2026: CVE-2025-39682 (CVSS 9.8, kTLS receive-path improper condition check), CVE-2026-53266 (CVSS 8.8, ebtables SNAT out-of-bounds write), and…
Federal civilian agencies must remediate the KEV trio by September 21, 2026, and perform forensic triage; sources disagree on the governing directive (BOD 26-04 per Cyber Security News vs. BOD 22-01 per Security Affairs).
Exploitation evidence for the KEV trio: public exploits exist for CVE-2025-39682; CVE-2026-53266 has a known exploit per Red Hat; STAR Labs demonstrated privilege escalation and container escape with the 14-year-old CVE-2025-39964 in…
Sources disagree on CVE-2025-39682's attack vector: Cyber Security News describes it as remotely triggerable on internet-accessible kTLS services, while Security Affairs describes it as affecting authenticated local users.
A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially…
ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is…
ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is configured to allow unprivileged mounts of removable media) and then leveraging local access to trigger an out-of-bounds read. A length value can be larger than the amount of memory allocated. NOTE: the supplier's perspective is that there is no vulnerability when an attack requires an attacker-modified filesystem image.
Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS
The Linux kernel's in-kernel TLS (kTLS) implementation mishandles zero-length records on the rx_list: each recvmsg() call must process either contiguous DATA records or a single non-DATA record, and the missed corner case occurs when the initial record is pulled from the rx_list and is zero length, breaking the check on record-type changes after zero-copy decryption. A local, low-privileged attacker able to use kTLS sockets can trigger this flaw, and the CVSS vector indicates high confidentiality impact (kernel information disclosure) and high availability impact (crash/DoS), with no integrity impact. Any Linux deployment running a kernel with the TLS (kTLS) feature enabled is affected, including Debian systems, which are listed as affected vendors in CISA's data. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed.
Do: Update the Linux kernel to a release containing the upstream fix for this kTLS rx_list issue, applying Debian security updates where applicable, consistent with CISA BOD 26-04 patching guidance. As an interim mitigation, check whether kernel TLS is active (e.g., 'lsmod | grep tls' or CONFIG_TLS in the running kernel) and unload/disable the tls module on hosts that do not require kTLS. Limit local unprivileged access on multi-user systems, since exploitation requires a local low-privileged user.
9.8
3%
KEV
Linux Kernel
Debian Linux
mass≈100M+ systems potentially exposed (Linux kernel ubiquitous; only hosts with the kTLS module enabled and in use are vulnerable)
Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg)
CVE-2025-39964 is a race condition (CWE-362) in the Linux kernel's AF_ALG crypto socket interface: the af_alg_sendmsg function did not prevent concurrent writes to the same socket, so two simultaneous writes could interleave data unpredictably and leave the kernel's internal socket state inconsistent. It is triggered by a local user (or local process) issuing concurrent write/sendmsg operations on the same AF_ALG socket, which is why the CVSS v3.1 score is low (3.3, local vector, low availability impact). An attacker exploiting the race primarily gains the ability to corrupt socket state, with potential for degraded availability; confidentiality and integrity are not rated as impacted. Any Linux kernel deployment whose build includes the vulnerable af_alg code is affected, though exploitation requires the ability to run local code that uses the crypto socket API. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild per CISA, but no public proof-of-concept is known and ransomware use is unknown; EPSS estimates a 0.3% probability of exploitation in the next 30 days.
Do: Apply a kernel update from your distribution or vendor that includes the upstream fix 'crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg'; CISA KEV requires mitigating per BOD 26-04 guidance, so prioritize internet-exposed and multi-user systems. Because the vector is local, reduce exposure by limiting untrusted local code execution and auditing hosts that expose crypto-socket workloads; verify the fix by confirming your running kernel includes the af_alg_sendmsg exclusive-ownership patch.
A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially…
A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially resulting in loss of confidentiality.
Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge)
CVE-2026-53266 is an out-of-bounds write (CWE-787) in the Linux kernel's netfilter bridge ebtables SNAT target: when the optional ARP sender-hardware-address rewrite is active, the kernel writes the new MAC address via skb_store_bits() without first making that byte range writable. If the ARP sender hardware address bytes sit in a nonlinear skb fragment backed by a splice-imported file page, the write maps the fragment page and copies the MAC directly into a file-backed page-cache page, corrupting kernel-managed memory. A local, low-privileged attacker (for example a container tenant, VM, or user able to send traffic into a bridge using ebtables SNAT with ARP rewriting) can trigger this with crafted ARP packets, gaining kernel memory corruption usable for privilege escalation or integrity/availability impact (CVSS 3.1 8.8, scope changed). Any Linux system running a kernel with the vulnerable ebtables SNAT code in a bridged-networking configuration that performs this ARP rewrite is affected; the source data does not state specific affected version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation, although EPSS is low (0.1%, 2nd percentile) and no public proof-of-concept is known.
Do: Update the kernel via your vendor's stable/security channel to a build that includes the upstream fix 'netfilter: bridge: make ebt_snat ARP rewrite writable', prioritizing internet-exposed and multi-tenant hosts in line with CISA BOD 26-04. Audit bridges, routers, gateways and virtualization hosts for ebtables SNAT rules that rewrite ARP sender hardware addresses and remove or disable those rules as an interim mitigation where patching is not yet possible. Restrict untrusted local/guest access to systems using ebtables bridging until patched.
Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject)
CVE-2026-68121 is a use-after-free in the Linux kernel's PPPoE implementation: pppoe_sendmsg() caches a pointer to the PPPoE header before calling dev_hard_header(), but device header callbacks are allowed to reallocate the socket buffer head, leaving that pointer dangling. The race is triggered when a send blocks in copy_from_user() while the first non-Ethernet port is added to an empty team device, causing the team's delegated GRE header callback to expand the skb head; PPPoE then writes six bytes through the stale pointer into freed memory. A local attacker can leverage this memory corruption for privilege escalation, reportedly reaching a root shell as one of four recently disclosed Linux kernel LPE flaws dubbed 'PPPoEject'. Any Linux system with PPPoE support enabled is potentially affected, though practical exploitation requires local code execution plus the uncommon combination of a PPPoE socket and a team device. A public proof-of-concept has been published on GitHub, but the flaw is not in CISA's KEV catalog and EPSS remains low at 0.1%.
Do: Update to the latest stable or vendor-supplied kernel that includes the upstream fix ('pppoe: reload header pointer after dev_hard_header()') as soon as your distribution backports it. Until patched, restrict local untrusted code execution on PPPoE-connected hosts and avoid combining PPPoE interfaces with team bonding devices or adding non-Ethernet ports to team devices on such hosts. Verify with your kernel vendor whether your running kernel contains the corrected pppoe_sendmsg() and watch distribution security advisories for the backport.
Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit…
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.
Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation
The Linux kernel's IPv6 Authentication Header implementation (net/ipv6/ah6, part of xfrm) fails to validate the segments_left field of an IPv6 routing header before rearranging addresses for ICV computation, so a crafted raw IPv6 (IP_HDRINCL) packet with hdrlen=2 but segments_left=255 drives pointer arithmetic and a memmove roughly 4,064 bytes out of bounds. A local attacker who can open raw sockets (e.g., holding CAP_NET_RAW, which is commonly granted in containers) can trigger this kernel memory corruption — publicly tracked under the name 'DirtyAH6' — and potentially escalate privileges to root. Any Linux system whose kernel includes IPv6 AH support (the ah6 module) is affected, which spans most mainstream distribution kernels on servers, cloud hosts, containers, and embedded devices. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.2% probability of exploitation within 30 days (9th percentile).
Do: Update to a kernel containing the upstream xfrm/ah6 fix once your distribution ships it (no fixed version number appears in the source data, so follow distro advisories for CVE-2026-80844). As interim mitigations, blacklist or avoid loading the ah6 module if you do not use IPsec AH, and remove or restrict CAP_NET_RAW from containers and unprivileged users. Check exposure on hosts with 'lsmod | grep ah6' and audit container runtime capability grants for CAP_NET_RAW.
Linux kernel TUN/TAP headroom integer underflow enables local memory corruption
An integer underflow in the Linux kernel's TUN/TAP driver (net/tun.c) lets tun_get_user() compute a negative linear data size when the configured headroom (tun->align) exceeds the one-page skb-head budget; the value wraps when stored as a size_t, so tun_alloc_skb() can place skb->data outside the allocated buffer. The oversized headroom can be set locally or propagated to a TUN/TAP port by Open vSwitch when packets arrive from another port, so triggering requires injecting packets into a TUN/TAP device with a large alignment value, which needs local access with privileges. Successful exploitation corrupts kernel memory adjacent to the skb, giving a local attacker full confidentiality, integrity, and availability impact (CVSS 7.8), i.e., potential ring-0 code execution and complete host compromise. Any system running a kernel with the vulnerable tun_get_user() logic is affected, with VPN gateways, container hosts, and Open vSwitch/SDN deployments the most likely exposure paths. No public PoC is known, the flaw is not in CISA's KEV, and no exploitation in the wild has been reported.
Do: Apply a kernel update containing the upstream fix commit "net: tun: bound receive headroom" as soon as your distribution or vendor backports it. In the interim, restrict access to /dev/net/tun and CAP_NET_ADMIN for untrusted local users and containers, and review Open vSwitch bridges that forward traffic from ports with large headroom requirements into TUN/TAP ports. Monitor kernel logs for OOPS or BUG output in the tun_get_user/tun_alloc_skb paths as a sign of attempted abuse.
7.8
<1%
PoC ×2
Linux kernel
massorder of billions of Linux-based systems (servers, Android devices, embedded/appliance kernels) ship the affected mainline kernel code
KEV
Linux kernel
mass≈ billions of devices ship the affected kernel code across distributions, servers, cloud, Android and embedded; realistically exploitable hosts (bridges with…
KEV
Linux kernel (PPPoE subsystem, pppoe_sendmsg())
massHundreds of millions of Linux installations ship the vulnerable PPPoE code (enabled by default in mainstream distributions), though PPPoE-plus-team-device…
mass
≈10^8–10^9 Linux systems ship the affected code path (kernel ubiquitous; ah6 compiled into most mainstream distro kernels), though only…
Linux kernel (net/tun.c TUN/TAP driver)
mass≈hundreds of millions of devices run kernels containing the affected driver; millions of hosts actively use TUN/TAP (VPN gateways, container networking, Open…
oss-security· 48