Four Linux Kernel Vulnerabilities Threaten System Integrity, Enabling Root Access
Four newly disclosed Linux kernel vulnerabilities, collectively named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, pose a significant risk by allowing local attackers to escalate privileges to root.
A quartet of critical vulnerabilities discovered in the Linux kernel could grant local attackers the ability to escalate their privileges to root, potentially compromising the integrity of affected systems. These flaws, identified as DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469), all reside within long-standing networking code and have now been addressed with upstream fixes.
The DirtyAH6 vulnerability, tracked as CVE-2026-80844, impacts the IPv6 Authentication Header processing within the Linux IPsec/XFRM subsystem. It arises from the kernel's failure to properly validate the segments_left field when handling malformed IPv6 routing-header values. This oversight can lead to an internal pointer being moved outside its intended memory bounds, triggering an out-of-bounds memory operation. While primarily a local privilege escalation vector, systems acting as IPv6 routers or gateways that utilize AH in transport mode could face a remote denial-of-service risk under specific, narrow conditions.
TUNderflow, identified by CVE-2026-81000, is found within the TUN/TAP virtual network-device subsystem. A malicious local user can exploit this flaw by manipulating oversized receive-headroom values, particularly in configurations involving Open vSwitch paths. This manipulation causes an integer underflow during socket-buffer allocation, potentially leading to packet data being written outside its allocated memory area, thereby enabling out-of-bounds reads and writes.
PPPoEject, or CVE-2026-68121, is a use-after-free vulnerability affecting the Linux PPP over Ethernet implementation. The issue occurs in the pppoe_sendmsg() function, which retains a pointer to a PPPoE header while invoking a lower-level device-header function. If this callback reallocates the socket buffer, the original pointer becomes invalidated. Subsequent writes through this stale pointer can corrupt freed kernel memory. The provided patch rectifies this by reloading the header pointer after the device-header creation.
DiagSpill, tracked as CVE-2026-74469, targets the SCTP diagnostic reporting mechanism via sock_diag. The vulnerability stems from the fact that an SCTP association can accommodate up to 65,536 peer transports, yet the associated counter is only a 16-bit integer. When this counter reaches its limit, it wraps around to zero. This causes the diagnostic code to allocate insufficient space before copying peer information, resulting in an overwrite that extends far beyond the intended Netlink response buffer. Notably, DiagSpill does not require unprivileged user namespaces or special Linux capabilities if SCTP and sctp_diag support are enabled, though remote crash conditions might exist if SCTP address-configuration features are active.
These vulnerabilities were reported to the Linux kernel security team in mid-July by researcher Asim Viladi Oglu Manizada. Coordinated disclosure led to the release of patches, which are now available in supported stable kernel branches. Administrators are strongly advised to upgrade to kernel versions that incorporate all four fixes, including Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.
For organizations unable to patch immediately, mitigation strategies include restricting unprivileged user namespaces and disabling unused AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag functionalities. However, it is crucial to note that disabling user namespaces does not mitigate the DiagSpill vulnerability and should not be considered a substitute for applying official vendor kernel updates.