Four Kernel Flaws, Public Exploits, One Fix

Working exploit code for four Linux kernel flaws that each allow a local user to gain root has been published, turning private vulnerability research into a race for anyone still running an older kernel. All four have already been fixed upstream, but the public release of the code means unpatched machines now face a known and documented path to full system control.

The flaws are named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. Researcher Asim Manizada found them and reported them to the Linux kernel security team in mid-July, and he published a technical write-up with working exploits on September 18, after a coordinated hold with Linux distributions so the fixes could be released first.

There are no reports so far of the four being used in real-world attacks. The exploits are Manizada's own, are tuned to specific kernel builds, and can crash a machine, so they are intended for isolated test systems rather than live production hosts.

Why Local Root Still Matters

Local privilege escalation is not a remote compromise on its own. It matters most where an attacker already holds some access — a low-privileged account on a multi-user server, for instance — and wants to move from a limited foothold to full control of the machine. That is the scenario these four bugs enable.

Because the code is now public, the risk profile on shared systems shifts. An unpatched host running an older kernel gives anyone with a basic user account a documented tool to attempt privilege escalation. The exploits carry a stability cost: they can crash the target, which makes them a blunt instrument but not a harmless one.

Kernel maintainers fixed all four over the past few weeks. A system running an up-to-date kernel is not affected. The problem is concentrated in machines that have not yet picked up those fixes, whether because of a stalled update schedule or a distribution that has not yet shipped the patch.

Three Bugs Need Namespaces Enabled

Three of the four flaws can be reached by an ordinary user only when unprivileged user namespaces are enabled. User namespaces are a Linux feature that lets a normal user act as root inside a private sandbox. Many distributions enable them by default, which is how an attacker gains the network privileges the exploits require.

DirtyAH6, TUNderflow, and PPPoEject all sit behind that same prerequisite. The fourth, DiagSpill, is the exception: it requires no user namespaces or special privileges, as long as the system has the SCTP networking module available.

Each flaw lives in a different part of the kernel's networking code:

• DirtyAH6 — CVE-2026-80844, in the IPsec AH6 (IPv6) code, requiring unprivileged user namespaces.
• TUNderflow — CVE-2026-81000, in TUN/TAP virtual network devices, requiring unprivileged user namespaces.
• PPPoEject — CVE-2026-68121, in PPPoE, requiring unprivileged user namespaces.
• DiagSpill — CVE-2026-74469, in SCTP (sctp_diag), requiring no local prerequisite.

The distinction matters for defenders. Turning off unprivileged user namespaces closes the ordinary-user path to three of the four, but it does nothing for DiagSpill.

Narrow Remote Paths, Mostly Crashes

Manizada also found that two of the flaws, DirtyAH6 and DiagSpill, can be triggered over the network, but only in narrow cases and mainly to cause the system to crash.

DirtyAH6 can crash a host that acts as an IPv6 router or gateway and adds an IPsec Authentication Header in transport mode. DiagSpill can crash a host only when certain SCTP options, which are off by default, are switched on.

Remote root is a much harder proposition. Manizada reached remote root with DirtyAH6 only in his own lab, and only by shaping memory on the target first. Doing that from a remote position alone, he wrote, "looks extremely difficult," though he did not rule it out. For DiagSpill, he said he sees no path to remote root at all, even with perfect memory shaping.

He also said the flaws could, in theory, allow an attacker to escape a container, but he did not build one. That caveat matters: a theoretical escape is not a demonstrated one, and the published exploits are built around privilege escalation on a host rather than breaking out of an isolated container.

Decades-Old Mistakes in Kernel Memory

All four are memory-safety bugs in different parts of the kernel's networking code. Each one allows an attacker to corrupt kernel memory, which Manizada then used to gain a root shell. The underlying mistakes are old, ranging from 10 to 21 years.

DirtyAH6 is in the IPsec code that handles the IPv6 Authentication Header. The code trusted a routing-header field without verifying it against the number of addresses present, so a crafted packet caused an internal pointer to move far out of bounds and write past the buffer.

TUNderflow is in the TUN and TAP virtual network devices. A single value was used both as spare space and as a size, and an oversized value passed in through Open vSwitch caused the size calculation to wrap around, so packet data landed outside its buffer.

PPPoEject is in the code for PPP over Ethernet. It kept a pointer into a network buffer while calling a device routine that could free and move that buffer, and the later writes then used freed memory, a bug known as a use-after-free.

DiagSpill is in the reporting code for SCTP. A counter that tracks connection endpoints is only 16 bits wide, so the 65,536th endpoint wrapped it back to zero. The reporting code then set aside no space but copied the full list, writing about 8 MiB of data past the end of its buffer.

An AI-Assisted Bug Hunt

Manizada said he found the four flaws with an AI-assisted process that builds a map of how the kernel handles memory and reasons about its layout. The kernel's fix for DirtyAH6 records this: the commit includes an "Assisted-by" line that credits his custom AI tooling.

This batch follows a run of Linux kernel privilege escalation flaws disclosed through 2026, several of them found with help from large language models. Manizada disclosed a similar Open vSwitch flaw, OVSwrap, in July.

One of the new exploits also reuses a technique from Dirty Frag, another Linux kernel root flaw disclosed in May by a different researcher. In his write-up, Manizada said this batch likely ends the public phase of his AI-assisted bug hunting.

Patch Before You Mitigate

The primary fix is to update to a kernel that carries all four fixes. The first stable kernel releases with the complete set are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.

Those are the version numbers from the main Linux kernel project. Most people run a kernel from a distribution instead, such as Debian, Ubuntu, Red Hat, or SUSE, which uses its own version numbers and adds these fixes on its own schedule. Check your distribution's security advisory to confirm it has shipped an update that includes all four, rather than matching the numbers above.

If patching immediately is not possible, two steps reduce the risk. Turn off unprivileged user namespaces, which closes the ordinary-user path to DirtyAH6, TUNderflow, and PPPoEject — though it does not stop DiagSpill, and it does not stop a container or process that already has network-admin privileges. Alternatively, turn off the affected features if you do not use them: AH6, TUN/TAP, PPPoE, and SCTP.

Manizada recommends patching rather than turning off features, because other paths to the same flaws may exist. That advice is worth weighing carefully: disabling a feature closes the route you know about, while a kernel update closes the underlying memory-safety bug.

The Coordination Window Has Closed

The release is a reminder of how coordinated disclosure works in practice. Manizada held the details back until distributions had a chance to ship fixes, then published once that window closed. The result is a set of bugs that are patched upstream but still exploitable wherever the update has not landed.

For organizations running multi-user Linux servers, the practical exposure is the gap between upstream fixes and fleet-wide deployment. A low-privileged account on an unpatched host is the relevant starting point, and the public code lowers the effort required to attempt escalation from there.

Systems that route IPv6 with IPsec Authentication Header in transport mode, or that run SCTP with non-default options enabled, carry an additional crash risk from remote sources. Those configurations are not universal, but they are specific enough to be worth checking against an inventory.

The broader pattern is one of speed. Fixes for all four exist, the version numbers are public, and the exploits are public alongside them. The remaining question for any given system is simply whether the patch has arrived yet.