Linux Kernel: Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access

Four Critical Linux Kernel Vulnerabilities Enable Privilege Escalation and Memory Corruption

Four newly disclosed Linux kernel vulnerabilities DirtyAH6, TUNderflow, PPPoEject, and DiagSpill could allow local attackers to corrupt kernel memory and escalate privileges to root on affected systems. The flaws, tracked as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469, impact long-standing networking code and have received upstream fixes.

Key Vulnerabilities and Impact

1. DirtyAH6 (CVE-2026-80844)

   • Affects IPv6 Authentication Header (AH) processing in Linux IPsec/XFRM code.
   • Occurs when the kernel improperly validates the segments_left field in malformed IPv6 routing headers, leading to out-of-bounds memory operations.
   • Primarily a local privilege escalation risk, though systems acting as IPv6 routers or gateways using AH in transport mode may face remote denial-of-service (DoS) under specific conditions.
   • A researcher demonstrated remote root access in a controlled lab environment, though such an attack is considered highly difficult in real-world scenarios.

2. TUNderflow (CVE-2026-81000)

   • Resides in the TUN/TAP virtual network-device subsystem.
   • Exploitable by a malicious local user who manipulates oversized receive-headroom values, causing an integer underflow during socket-buffer allocation.
   • Results in out-of-bounds reads and writes, potentially leading to memory corruption.

3. PPPoEject (CVE-2026-68121)

   • A use-after-free flaw in the Linux PPP over Ethernet (PPPoE) implementation.
   • The pppoe_sendmsg() function retains a pointer to a PPPoE header while calling a lower-level device-header function, which may reallocate the socket buffer and invalidate the original pointer.
   • Subsequent writes through the stale pointer can corrupt freed kernel memory.

4. DiagSpill (CVE-2026-74469)

   • Affects SCTP diagnostic reporting via sock_diag.
   • An SCTP association can contain up to 65,536 peer transports, but the counter is only 16 bits wide, causing it to wrap to zero when reaching the limit.
   • This leads to insufficient buffer allocation, resulting in a buffer overflow when copying peer information.
   • Unlike the other flaws, DiagSpill does not require unprivileged user namespaces if SCTP and sctp_diag support are enabled.
   • Remote crash conditions may exist if SCTP address-configuration features are enabled, though these are disabled by default.

Disclosure and Mitigation

Researcher Asim Viladi Oglu Manizada reported the vulnerabilities to the Linux kernel security team in mid-July. Patches were released through coordinated disclosure and are now available in supported stable kernel branches.

Affected systems should upgrade to the following kernel versions:

• 5.10.270
• 5.15.221
• 6.1.188
• 6.6.157
• 6.12.109
• 6.18.50
• 7.2.4

For systems unable to patch immediately, mitigations include:

• Restricting unprivileged user namespaces (does not mitigate DiagSpill).
• Disabling unused functionality (AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag).

However, vendor kernel updates remain the recommended solution.

Source: https://cybersecuritynews.com/linux-kernel-privilege-escalation-flaws/

Linux Kernel TPRM report: https://www.rankiteo.com/company/linux-kernel-foundation

"id": "lin1789799026",
"linkid": "linux-kernel-foundation",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Systems running affected Linux '
                                              'kernel versions (5.10.x, '
                                              '5.15.x, 6.1.x, 6.6.x, 6.12.x, '
                                              '6.18.x, 7.2.x)',
                        'industry': 'Technology/Software',
                        'location': 'Global',
                        'name': 'Linux Kernel',
                        'type': 'Operating System'}],
 'attack_vector': ['Local', 'Remote (under specific conditions)'],
 'date_detected': '2026-07',
 'description': 'Four newly disclosed Linux kernel vulnerabilities (DirtyAH6, '
                'TUNderflow, PPPoEject, and DiagSpill) could allow local '
                'attackers to corrupt kernel memory and escalate privileges to '
                'root on affected systems. The flaws impact long-standing '
                'networking code and have received upstream fixes.',
 'impact': {'operational_impact': ['Privilege escalation to root',
                                   'Memory corruption',
                                   'Potential remote DoS'],
            'systems_affected': 'Linux systems with affected kernel versions'},
 'investigation_status': 'Patches released, ongoing monitoring for '
                         'exploitation',
 'post_incident_analysis': {'corrective_actions': ['Kernel patches applied',
                                                   'Code reviews for similar '
                                                   'vulnerabilities in '
                                                   'networking subsystems'],
                            'root_causes': ['Improper validation of IPv6 '
                                            'routing headers (DirtyAH6)',
                                            'Integer underflow in TUN/TAP '
                                            'subsystem (TUNderflow)',
                                            'Use-after-free in PPPoE '
                                            'implementation (PPPoEject)',
                                            'Buffer overflow in SCTP '
                                            'diagnostic reporting '
                                            '(DiagSpill)']},
 'recommendations': ['Upgrade to the latest patched kernel versions',
                     'Restrict unprivileged user namespaces where possible',
                     'Disable unused networking functionality to reduce attack '
                     'surface'],
 'references': [{'source': 'Linux Kernel Security Team'}],
 'response': {'containment_measures': ['Kernel patches released',
                                       'Restricting unprivileged user '
                                       'namespaces',
                                       'Disabling unused functionality (AH6, '
                                       'TUN/TAP, PPPoE, SCTP, or sctp_diag)'],
              'remediation_measures': ['Upgrade to patched kernel versions '
                                       '(5.10.270, 5.15.221, 6.1.188, 6.6.157, '
                                       '6.12.109, 6.18.50, 7.2.4)']},
 'title': 'Four Critical Linux Kernel Vulnerabilities Enable Privilege '
          'Escalation and Memory Corruption',
 'type': ['Privilege Escalation',
          'Memory Corruption',
          'Denial-of-Service (DoS)'],
 'vulnerability_exploited': ['CVE-2026-80844',
                             'CVE-2026-81000',
                             'CVE-2026-68121',
                             'CVE-2026-74469']}