Four serious Linux kernel vulnerabilities—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—now have public exploit code available, meaning attackers with local access can escalate privileges to root. Systems not yet patched are at high risk and should be updated immediately to the latest kernel releases.
🔎 The Four Vulnerabilities
| Flaw Name | CVE ID | Kernel Area | Requirements | Remote Reachability |
|---|---|---|---|---|
| DirtyAH6 | CVE-2026-80844 | IPsec AH6 (IPv6) | Needs unprivileged user namespaces or CAP_NET_ADMIN/CAP_NET_RAW | Crash only; remote root extremely difficult |
| TUNderflow | CVE-2026-81000 | TUN/TAP virtual network devices | Needs unprivileged user namespaces | No remote path |
| PPPoEject | CVE-2026-68121 | PPPoE networking | Needs unprivileged user namespaces | No remote path |
| DiagSpill | CVE-2026-74469 | SCTP (sctp_diag) | No namespaces or special privileges required | Crash only with non-default SCTP options |
⚠️ Exploit Details
- Researcher Asim Manizada released working exploit code on September 18, 2026, after a coordinated disclosure with Linux distributions.
- Exploits are functional proof-of-concepts tuned to specific kernel builds. They can crash systems, so they are mainly for testing.
- Public availability raises risk: attackers with low-privileged accounts on shared servers can now attempt root escalation.
🛡️ Mitigation & Fixes
- Patched kernel versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4 include fixes for all four flaws.
- Immediate steps if patching is delayed:
- Disable unprivileged user namespaces (blocks DirtyAH6, TUNderflow, PPPoEject).
- Disable unused AH6, TUN/TAP, PPPoE, and SCTP/sctp_diag functionality.
- Restrict container access, since these flaws can corrupt the host kernel from inside containers.
🚨 Risk Assessment
- DirtyAH6 & DiagSpill: Limited remote attack paths exist, but practical remote root exploitation is considered extremely difficult.
- Local root escalation: All four exploits allow a normal user to gain full root privileges if prerequisites are met.
- Container escape risk: Vulnerabilities can corrupt the host kernel from within containers, raising concerns for cloud and multi-tenant environments.
✅ Action Plan for Admins
- Update kernels immediately to patched versions.
- Audit system modules: check if AH6, TUN/TAP, PPPoE, or SCTP are enabled.
- Disable unprivileged namespaces if your workloads don’t require them.
- Monitor logs for unusual crashes or privilege escalation attempts.
- Isolate test environments before running public exploit code.
By
