Public exploits expose four Linux kernel local root flaws

Security researcher Asim Manizada has released working exploit code for four Linux kernel vulnerabilities that can allow a local user to obtain root privileges. The flaws, dubbed DirtyAH6, TUNderflow, PPPoEject and DiagSpill, were reported to the Linux kernel security team in mid-July and publicly documented on September 18 after a coordinated period intended to let distributions ship fixes.

All four issues have been fixed upstream. The first stable Linux kernel releases carrying the complete set are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. Organisations using Debian, Ubuntu, Red Hat, SUSE or another distribution should check the relevant security advisory, because vendors backport fixes and use their own package versioning.

Four networking bugs with local root potential

DirtyAH6 is tracked as CVE-2026-80844 and affects IPv6 IPsec Authentication Header handling. TUNderflow, CVE-2026-81000, is in TUN/TAP virtual network devices. PPPoEject, CVE-2026-68121, affects PPP over Ethernet, while DiagSpill, CVE-2026-74469, is located in SCTP diagnostic reporting code.

Manizada’s exploits are tuned to specific kernel builds and can crash a machine, making them unsuitable for production testing. There are no reported cases of the four flaws being used in attacks. Their publication nevertheless raises the risk for shared systems where an attacker has already obtained a low-privileged account and seeks full control of the host.

Three vulnerabilities—DirtyAH6, TUNderflow and PPPoEject—are ordinarily reachable by an unprivileged user when user namespaces are enabled. This Linux feature lets a regular user act as root within an isolated namespace and can provide the network privileges required by the exploits. DiagSpill is different: it needs no user namespace or special privilege if the SCTP module is available.

Remote effects are narrowly constrained

DirtyAH6 and DiagSpill can be triggered over a network in limited configurations, principally to crash a host. DirtyAH6 requires a host to route IPv6 and add an Authentication Header in transport mode. DiagSpill requires SCTP options that are disabled by default. Manizada achieved remote root with DirtyAH6 only in a lab after shaping target memory, a condition he described as extremely difficult to achieve remotely alone.

The broader Linux threat context is reflected in Linux rootkit and router zero-day risks and reinforces why local access on multi-user infrastructure must not be treated as a low-impact foothold. Manizada said DiagSpill has no apparent path to remote root even with ideal memory shaping, and noted that container escape could be possible in theory but was not demonstrated.

Patch first, then reduce exposure where necessary

All four are memory-safety defects in kernel networking code. DirtyAH6 involves an unchecked routing-header field that can move an internal pointer out of bounds. TUNderflow results from a value serving as both spare space and size, enabling an integer wrap in an Open vSwitch path. PPPoEject is a use-after-free, and DiagSpill can overflow a buffer after a 16-bit SCTP endpoint counter wraps at 65,536 entries.

If immediate patching is impossible, disabling unprivileged user namespaces reduces exposure to DirtyAH6, TUNderflow and PPPoEject, though it does not address DiagSpill or processes that already hold network-admin privileges. Disabling unused AH6, TUN/TAP, PPPoE and SCTP functionality can also reduce exposure. The practical business implication is to verify that deployed distribution kernels include every fix, schedule updates promptly and apply temporary configuration controls only until patching is complete.