Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell

Linux administrators are being urged to patch four newly disclosed local privilege escalation (LPE) vulnerabilities, collectively known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. These vulnerabilities can allow attackers to corrupt kernel memory and gain root-level access on affected systems.

The vulnerabilities are tracked under the following CVE identifiers: CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. They affect long-standing network code in the Linux kernel.

Researcher Asim Viladi Oglu Manizada reported the issues to the Linux kernel security team in mid-July, and fixes have since been included in supported stable kernel branches.

Linux Kernel Hit by 4 LPE Flaws

• DirtyAH6 (CVE-2026-80844): This vulnerability affects the handling of the IPv6 Authentication Header in Linux’s XFRM/IPsec implementation. An incorrectly validated routing header field can lead to an out-of-bounds memory operation. Although the demonstrated local exploit requires unprivileged user namespaces, the underlying issue can also result in a remote denial-of-service condition on systems acting as IPv6 routers or gateways that utilize AH in transport mode. The researcher indicated that remote code execution was achieved in a controlled lab environment with memory manipulation. However, such exploitation is deemed highly difficult.
• TUNderflow (CVE-2026-81000): This is an integer-underflow vulnerability within the TUN/TAP virtual networking subsystem. A specially crafted network device path can propagate excessive receive headroom values to a raw TUN device, causing calculations for socket buffer allocation to wrap. As a result, packet handling may read or write outside allocated kernel memory.
• PPPoEject (CVE-2026-68121): This vulnerability exists in the processing of PPP over Ethernet. It arises from `pppoe_sendmsg()` retaining a pointer in a socket buffer after a lower-level device callback has reallocated and freed that buffer’s memory. Subsequent writes through this stale pointer can create a use-after-free condition, which may be exploited for local root escalation.
• DiagSpill (CVE-2026-74469): This flaw impacts SCTP diagnostic reporting through `sock_diag`. An SCTP association can have up to 65,536 peer transports, but the corresponding counter is only 16 bits wide. When the count wraps to zero, the kernel allocates insufficient Netlink response space before copying peer transport data, leading to an overwrite of approximately 8 MB.

All four vulnerabilities are memory corruption issues, and exploit reliability depends on the target system’s memory layout and grooming. However, proof-of-concept exploits published by the researcher demonstrate the ability to gain root shell access under certain configurations.

The first three vulnerabilities typically rely on unprivileged user namespaces, a feature generally accessible to regular local users and containers. DiagSpill is considered more serious from an access control perspective, as it does not require unprivileged user namespaces or special Linux capabilities when SCTP and `sctp_diag` support are available.

Mandatory access control technologies, such as AppArmor and SELinux, did not block the reported exploit paths during the researcher’s testing.

Organizations should upgrade to a kernel version that includes patches for all four vulnerabilities. The first stable versions that fully address these issues are Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.

If immediate patching is not feasible, administrators can reduce exposure by turning off unprivileged user namespaces. However, this will not mitigate risks from DiagSpill or threats stemming from already privileged containers.

Turning off unused functionalities such as AH6, TUN/TAP, PPPoE, SCTP, and `sctp_diag` can provide additional defense-in-depth; however, applying vendor kernel updates remains the recommended method of mitigation.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC