Linux kernel security wave: public exploits for four local-root flaws (DirtyAH6, PPPoEject, TUNderflow, DiagSpill) and CISA KEV listing of three actively exploited bugs drive…

Researcher Asim Manizada released working exploits for four Linux kernel local privilege escalation flaws fixed in stable kernels 5.10.270–7.2.4, while CISA separately added three actively exploited kernel bugs (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)…

Two distinct clusters of Linux kernel vulnerabilities dominated the September 18–21, 2026 reporting window. First, on September 18, security researcher Asim Manizada published a write-up with working exploit code for four Linux kernel memory-safety bugs enabling local privilege escalation to root: DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP). The bugs, aged 10–21 years, were found via an AI-assisted memory-layout analysis process, reported to the kernel security team in mid-July, and fixed in stable kernels 5.10.270 through 7.2.4. Three of the flaws require unprivileged user namespaces, while DiagSpill needs only the SCTP module; DirtyAH6 and DiagSpill can cause remote crashes in narrow configurations. No real-world exploitation has been reported for these four. An oss-security thread praised the advisory for listing fix commits, affected stable versions, exploitation prerequisites, and affected subsystems, but flagged distribution patching obstacles: Gentoo's package manager cannot implement split subpackages, leaving gentoo-kernel-bin and binary package installs without a way to receive fixed kernels; commenters also indicated more LPE disclosures appear to be coming. Second, on the same day, CISA added three different Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation: CVE-2025-39682 (CVSS 9.8, improper condition check in the kernel TLS receive path allowing zero-length records to bypass recvmsg() type handling, enabling denial of service or memory disclosure), CVE-2026-53266 (CVSS 8.8, out-of-bounds write in the netfilter bridge ebtables SNAT ARP-rewriting path, triggerable by a crafted ARP packet, enabling memory corruption, crashes, or privilege escalation), and CVE-2025-39964 (CVSS 7.8, race condition in AF_ALG sockets allowing concurrent sendmsg() writes to corrupt crypto socket state, causing crashes or altered cryptographic results). Federal civilian agencies were required to remediate by September 21, 2026, and to perform forensic triage for evidence of compromise. Sources disagree on two points: the governing directive is cited as BOD 26-04 by Cyber Security News but BOD 22-01 by Security Affairs, and CVE-2025-39682 is described as remotely triggerable on internet-accessible kTLS services by Cyber Security News while Security Affairs frames it as affecting authenticated…