Public Exploits Released for Four Linux Kernel Flaws That Can Grant Local Root
Summary
Working exploits are public for four patched Linux kernel flaws that can grant local root. Older kernels remain at risk; the article reports no real-world exploitation and recommends updating or temporarily disabling affected features.
Key points
- The four flaws—DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) and DiagSpill (CVE-2026-74469)—are memory-safety bugs in Linux networking code.
- A researcher published working exploit code on September 18 after fixes were released. The exploits are tuned to specific kernel builds and may crash systems.
- Three flaws require unprivileged user namespaces for ordinary-user access. DiagSpill requires no special privileges if SCTP is available.
- The article reports no real-world attacks. Remote triggering is limited to narrow crash scenarios; remote root was demonstrated only for DirtyAH6 in the researcher’s lab and was described as extremely difficult.
- Kernel releases listed with all four fixes range from 5.10.270 through 7.2.4. Distribution kernels may use different version numbers, so users should check their distribution’s advisories.
- Update to a kernel containing all four fixes. If patching is delayed, disabling unprivileged user namespaces and unused affected features can reduce risk, but does not address every path.
Article Details
- Vulnerability Types
- Kernel memory-safety flaws: out-of-bounds writes and use-after-free
- Exploitation Status
- not_reported
- Exploit Availability
- public_exploit
- Patch Status
- available
- Workarounds
- Disable unprivileged user namespaces to reduce exposure to DirtyAH6, TUNderflow, and PPPoEject; this does not stop DiagSpill or processes that already have network-admin privileges.
- Disable unused affected features: AH6, TUN/TAP, PPPoE, and SCTP.
People
Products
Linux kernelA security researcher published working exploit code for four Linux kernel flaws—DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—that can let a local attacker gain root on unpatched systems.Open vSwitchA single value was used both as spare space and as a size, and an oversized value passed in through Open vSwitch caused the size calculation to wrap around, so packet data landed outside its buffer.