# Four Linux Kernel Vulnerabilities Exposed as Working Exploits Reach the Public
A set of four local privilege escalation vulnerabilities in the Linux kernel has been documented with working exploit code after a coordinated disclosure process between the researcher and kernel maintainers. The findings highlight ongoing risks for systems that have not yet applied the latest security patches.
## The Four Vulnerabilities
The flaws, identified by security researcher Asim Manizada, were reported to the Linux kernel security team in mid-July. They affect distinct subsystems within the kernel’s networking stack, each rooted in memory-safety errors that can allow an unprivileged local user to escalate to root-level access.
| Flaw Name | CVE Identifier | Affected Subsystem | Privilege Prerequisite |
|———–|—————|——————-|———————-|
| DirtyAH6 | CVE-2026-80844 | IPv6 IPsec Authentication Header | Unprivileged user namespaces |
| TUNderflow | CVE-2026-81000 | TUN/TAP virtual network devices | Unprivileged user namespaces |
| PPPoEject | CVE-2026-68121 | PPP over Ethernet | Unprivileged user namespaces |
| DiagSpill | CVE-2026-74469 | SCTP diagnostic interface | None required |
### Understanding the Attack Surface
Three of the four vulnerabilities require unprivileged user namespaces to be enabled on the target system. User namespaces are a Linux feature that permits a regular user to operate with root-level privileges inside an isolated sandbox environment. Many Linux distributions activate this capability by default, which inadvertently opens the door to exploitation.
DiagSpill stands apart as the only flaw in the group that does not depend on user namespaces or any special privileges, provided the SCTP networking module is present on the system.
### Remote Exploitation Potential
While two of the flaws—DirtyAH6 and DiagSpill—can theoretically be triggered over a network, the conditions are extremely narrow and limited to causing system crashes rather than granting access. DirtyAH6 demands that the host function as an IPv6 router or gateway and that IPsec Authentication Headers be applied in transport mode. DiagSpill requires non-default SCTP configuration options that are disabled by default.
In laboratory conditions, the researcher achieved remote root access through DirtyAH6 only after carefully manipulating memory on the target machine beforehand. He noted that reproducing this result from a remote position without prior setup would be extraordinarily difficult. No path to remote root was identified for DiagSpill under any tested scenario.
## Technical Details of Each Vulnerability
**DirtyAH6** resides in the IPsec code responsible for processing the IPv6 Authentication Header. The implementation trusted a routing header field without validating it against the actual number of addresses present, allowing a specially crafted packet to push an internal pointer beyond buffer boundaries and into kernel memory.
**TUNderflow** exists in the TUN and TAP virtual network device drivers. A single variable served dual purposes as both spare buffer space and a size indicator. When an oversized value was supplied through Open vSwitch, the size calculation wrapped around to zero, causing packet data to be written outside its allocated buffer.
**PPPoEject** affects the PPP over Ethernet implementation. The code maintained a pointer to a network buffer while simultaneously invoking a device routine that could deallocate and relocate that buffer. Subsequent write operations then accessed already-freed memory, a classic use-after-free condition.
**DiagSpill** is located in the SCTP connection reporting subsystem. A counter used to track connection endpoints is only 16 bits in width, meaning it resets to zero upon reaching 65,536 endpoints. The reporting code then allocated insufficient space while attempting to copy the full list, resulting in approximately 8 megabytes of data overflowing the buffer’s boundaries.
## Affected Kernel Versions and Patch Availability
All four vulnerabilities have been resolved in recent kernel updates. The following stable kernel releases contain the complete set of fixes:
– Kernel 5.10.270
– Kernel 5.15.221
– Kernel 6.1.188
– Kernel 6.6.157
– Kernel 6.12.109
– Kernel 6.18.50
– Kernel 7.2.4
These version numbers correspond to the upstream Linux kernel project. Most enterprise and consumer systems run distribution-specific kernels from vendors such as Debian, Ubuntu, Red Hat, SUSE, and others. These distributions apply patches on their own release timelines, often with different version numbering schemes. System administrators should consult their distribution’s official security advisory to verify that their specific kernel package includes all four fixes.
## Recommended Mitigation Steps
### Immediate Actions
1. **Apply kernel updates** as soon as they become available from your distribution vendor.
2. **Verify the patch level** by checking your distribution’s security tracker rather than relying solely on upstream version numbers.
### Interim Measures (If Patching Is Delayed)
For environments where immediate patching is not feasible, two risk-reduction steps can be taken:
– **Disable unprivileged user namespaces.** This action blocks the standard user path to DirtyAH6, TUNderflow, and PPPoEject. Note that this does not prevent DiagSpill, nor does it stop a container or process that already possesses network administration privileges.
– **Disable unused networking features.** If AH6, TUN/TAP, PPPoE, and SCTP are not in active use, turning them off reduces the attack surface.
The researcher emphasizes that patching remains the preferred approach because other exploitation paths to the same underlying flaws may exist beyond the mitigations described above.
## Frequently Asked Questions
### Are these vulnerabilities being exploited in the wild?
There are no confirmed reports of these four flaws being used in real-world attacks. The exploit code was developed by the researcher for testing purposes and is calibrated to specific kernel builds, making accidental triggering in production environments unlikely.
### Can these vulnerabilities allow container escapes?
The researcher identified that the flaws could theoretically enable an attacker to break out of a container environment, but he did not build or demonstrate a working container escape. The risk remains theoretical at this time.
### How old are the underlying coding errors?
The root cause of each vulnerability traces back many years, with the mistakes ranging from approximately 10 to 21 years old. These are not newly introduced bugs but long-standing issues that persisted through kernel development.
### Do all Linux distributions need to be concerned?
Any system running a kernel version older than the patched releases listed above is potentially vulnerable. The level of risk depends on whether the specific preconditions for each flaw are met—for example, whether user namespaces are enabled or whether SCTP is loaded.
### What makes these vulnerabilities significant?
Local privilege escalation flaws are particularly consequential in multi-user environments where different users share a single machine. An attacker with a low-privilege account could use these exploits to gain complete administrative control over the system.
### Is the exploit code dangerous for well-patched systems?
No. Systems running an updated kernel that includes all four fixes are not affected by these exploits. The published code serves primarily as a proof of concept for testing and as a motivator for administrators to apply updates.
## Conclusion
The disclosure of these four Linux kernel vulnerabilities serves as a reminder of the importance of timely patch management. While no active exploitation has been observed, the public availability of working exploit code increases the urgency for system administrators to verify their kernel versions and apply the latest security updates. Organizations running Linux in multi-user or shared environments should pay particular attention, as the impact of a successful local privilege escalation could be severe. By staying current with distribution-provided kernel updates and following the interim mitigation guidance where necessary, administrators can effectively neutralize the threat posed by these flaws.
Thank you for reading
