Four Public Linux Kernel Exploits Put Unpatched Hosts at Risk of Local Root

Working exploit code raises the urgency

Security researcher Asim Manizada released technical details and functioning exploits on September 18, 2026, for four Linux kernel vulnerabilities capable of escalating local privileges to root.

The flaws are DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). Each affects a different part of the kernel’s networking stack, but all four involve unsafe memory handling in highly privileged code.

Manizada reported the vulnerabilities to the Linux kernel security team in mid-July. He then coordinated with Linux distributions before publishing the exploits, allowing maintainers time to distribute fixes.

No real-world exploitation has been reported. However, public code gives attackers a starting point for adapting the techniques to unpatched distribution kernels, especially on multi-user servers, shared infrastructure, and container hosts.

The released exploits are tuned for specific kernel builds and may crash their targets. They are better characterized as proof-of-concept research tools than dependable implants, but Manizada successfully used the underlying vulnerabilities to obtain root shells during testing.

Four bugs, four networking subsystems

DirtyAH6 affects the IPv6 IPsec Authentication Header implementation. The vulnerable code rearranges addresses in an IPv6 routing header before calculating or validating the Integrity Check Value.

The problem arises because ipv6_rearrange_rthdr() trusted the routing header’s segments_left field without ensuring it matched the number of addresses represented by hdrlen. With a raw IPv6 HDRINCL packet, hdrlen can indicate one address while segments_left contains a much larger value. Setting it to 255 moves an internal address pointer 4,064 bytes backwards, creating an out-of-bounds memory access and potential write.

TUNderflow resides in the TUN/TAP virtual networking code. Inside tun_get_user(), the kernel used tun->align both as socket-buffer headroom and in a calculation determining how much packet data should remain linear.

Open vSwitch can deliver an oversized headroom request from another port. If that value exceeds the usable area in a one-page socket-buffer head, SKB_MAX_HEAD(align) underflows. A negative intermediate value can subsequently wrap when assigned to an unsigned size_t, allowing tun_alloc_skb() to position skb->data outside its allocated buffer.

TUNderflow has a CVSS 3.1 score of 7.8, with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

PPPoEject affects PPP over Ethernet. In pppoe_sendmsg(), the kernel saved a pointer to a PPPoE header and then invoked dev_hard_header(). Device-specific callbacks can expand or reallocate the socket-buffer head, invalidating pointers into the original memory.

One triggering sequence involves a send operation blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. A delegated GRE-header callback can then relocate the buffer. PPPoE later writes six bytes through the stale pointer into freed memory, producing a use-after-free condition.

PPPoEject is also rated 7.8 under CVSS 3.1, with CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

DiagSpill is a counter-overflow flaw in sctp_diag. The sctp_assoc_add_peer() function increments a 16-bit transport_count for every unique SCTP peer. Adding the 65,536th transport wraps the counter to zero.

The SCTP diagnostic code then reserves an INET_DIAG_PEERS payload based on that zero value but still copies every structure in transport_addr_list. The result is an out-of-bounds write of approximately 8 MiB beyond the socket-buffer tail. The fix rejects new unique peers once transport_count reaches U16_MAX.

DiagSpill carries the highest score of the four: 8.8, with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

No CVSS v3 score or vector is available for DirtyAH6.

Local access requirements and limited remote effects

DirtyAH6, TUNderflow, and PPPoEject ordinarily require unprivileged user namespaces to be enabled. That facility lets an ordinary account acquire root-like capabilities inside an isolated namespace, including capabilities needed to access otherwise restricted networking paths.

Consequently, the three flaws are most relevant where local users can create their own namespaces. Disabling that functionality can remove the expected unprivileged entry point, although it does not protect processes or containers that already hold the necessary network-administration capabilities.

DiagSpill is different. Manizada described it as requiring neither user namespaces nor special privileges. The NVD vector nevertheless assigns PR:L, indicating low privileges are required under its scoring model. The reason for that discrepancy is not known.

Remote impact is narrower than the local-root risk. DirtyAH6 can crash an IPv6 router or gateway that routes IPv6 traffic and adds an IPsec Authentication Header in transport mode. Manizada achieved remote root only after deliberately shaping the target’s memory in a laboratory and assessed exploitation without such preparation as extremely difficult.

DiagSpill can remotely crash a system when the relevant non-default SCTP options are active. No viable path to remote root was found, even under favorable memory-layout assumptions.

No direct remote exploitation route has been reported for TUNderflow or PPPoEject. A container escape may be theoretically possible through the flaws, but none was developed or demonstrated.

Complete fixes begin with specific stable releases

The Linux kernel maintainers have corrected all four defects. The first upstream stable releases reported to contain the complete set of patches are:

• 5.10.270
• 5.15.221
• 6.1.188
• 6.6.157
• 6.12.109
• 6.18.50
• 7.2.4

These numbers should not be compared mechanically with the kernel strings reported by Debian, Ubuntu, Red Hat, SUSE, or other distributions. Vendors commonly backport security patches while retaining older base version numbers.

Administrators should verify that their distribution’s kernel package includes fixes for all four CVEs. Exact vulnerable-version ranges, distribution package versions, and vendor advisory identifiers are not known.

None of the four vulnerabilities has a reported CISA Known Exploited Vulnerabilities catalog entry or KEV remediation deadline. That aligns with the absence of reported attacks, but it does not reduce the exposure created by publicly available exploit code.

Which systems should receive priority

Patching should begin with systems where untrusted users can execute local code or create namespaces. High-priority targets include shared hosting platforms, research servers, development machines, container hosts, and other multi-user Linux environments.

Exposure is also higher where the affected networking features are actively used, including Open vSwitch, TUN/TAP, PPPoE, IPsec AH6, SCTP, team devices, and delegated GRE-header handling.

As temporary risk-reduction measures, administrators can disable unprivileged user namespaces and remove unused networking functionality. Disabling IPv6 AH6, TUN/TAP, PPPoE, or SCTP may make particular vulnerable paths unreachable.

Those controls are not substitutes for patched kernels. Alternative execution paths may exist, and DiagSpill is not addressed by disabling user namespaces.

Monitoring should focus on unexpected namespace creation, new TUN/TAP or SCTP configurations, unusual Open vSwitch and team-device activity, unexplained root shells, and kernel crashes involving the affected subsystems. Because the proofs of concept can destabilize a host, kernel faults may be an early sign of testing or failed exploitation.

AI-assisted research found decades-old mistakes

Manizada used custom AI-assisted analysis to model kernel memory behavior and reason about object layouts. The DirtyAH6 fix includes an “Assisted-by” attribution for that tooling.

The underlying programming errors are estimated to be between 10 and 21 years old. They include an unchecked packet field, an integer underflow followed by unsigned wrapping, a stale pointer retained across buffer reallocation, and a 16-bit counter overflow.

Manizada had also disclosed the OVSwrap Open vSwitch vulnerability in July. One of the new exploits reuses a technique from Dirty Frag, a separate Linux kernel root vulnerability disclosed by another researcher in May.

Public exploit reliability remains limited today. The more consequential development is that attackers can now study complete exploitation paths for four privileged networking bugs and retarget them for widely deployed distribution kernels. Patching closes that opportunity more reliably than configuration-based containment alone.