4 Linux Kernel LPE Flaws Disclosed With Public PoC Exploits

TL;DR

A researcher disclosed four Linux kernel privilege escalation flaws on September 18, 2026. Each one can give a local user root on affected systems. The full technical details and proof-of-concept exploit code are now public.

Why these Linux kernel vulnerabilities matter

The Linux kernel runs servers, clouds, and containers everywhere. A local root flaw breaks the last wall between users and full control. These four Linux kernel privilege escalation flaws each reach that outcome.

The underlying bugs are old, dating back 10 to 21 years. The researcher found them using AI-assisted analysis of kernel memory state. They then reported the issues to security@kernel.org in mid-July 2026.

Two of the corruption bugs also reach beyond local attackers. Under specific conditions, DirtyAH6 and DiagSpill can be triggered remotely. One is even described as theoretically groomable to remote root, though the researcher calls that extremely difficult.

The disclosure also stands out for its method. The researcher credits an AI-assisted harness that reasons about kernel memory layout. That approach has now surfaced several distinct Linux kernel privilege escalation bugs across separate write-ups. The write-up notes this likely ends the public phase of that experiment.

How the attacks work

All four are memory-safety bugs in kernel networking code. Below is the mechanism for each, without any exploit steps.

DirtyAH6 (CVE-2026-80844)

This flaw sits in IPsec’s IPv6 Authentication Header code. The function ipv6_rearrange_rthdr() failed to check a segments value before moving a pointer. As a result, a crafted packet caused an out-of-bounds memmove(). On an IPv6 router adding AH in transport mode, it can also cause a remote crash.

TUNderflow (CVE-2026-81000)

TUN and TAP are virtual network devices. The TUN code stored a receive-headroom value and reused it unsafely. An oversized headroom, passed through stacked network devices, caused a size_t underflow. The kernel then wrote data past a fixed allocation.

PPPoEject (CVE-2026-68121)

PPPoE carries PPP sessions inside Ethernet frames. The send path kept a pointer into a buffer across a device callback. That callback could free and move the buffer. The later writes then used a stale, dangling pointer.

DiagSpill (CVE-2026-74469)

SCTP tracks many peer transports per association. A 16-bit counter could wrap at 65,536 transports. The sctp_diag code then reserved no space but copied the full list. That spilled roughly 8 MiB past the response buffer. Notably, DiagSpill needs no unprivileged user namespaces.

Exploitation status

Public proof-of-concept exploits now exist for all four flaws. The researcher released them after a coordinated embargo with the kernel and distro teams. You can read the full LPE quartet write-up for the technical detail. The PoC code lives in dedicated repositories for DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. Each PoC is tuned to a specific distro and kernel, so the researcher advises running it only in throwaway VMs. No in-the-wild abuse has been confirmed.

Affected versions

The flaws affect a wide range of kernel series from 2.6.12 onward. The first three require unprivileged user namespaces for the local exploit. DiagSpill does not. Many older series are end-of-life with no upstream fix, so treat them as vulnerable.

Patch and mitigation steps

Upgrade to a kernel that carries all four fixes. The researcher lists the first such stable releases as 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Apply your distribution’s matching update as soon as it ships.

If you cannot patch at once, reduce exposure. Disabling unprivileged user namespaces blocks the ordinary-user path to the first three flaws. However, it does not stop suitably privileged containers, and DiagSpill stays reachable. You can also disable unused subsystems such as AH6, TUN, PPPoE, and SCTP. Notably, the researcher found that AppArmor and SELinux did not block the exploits in testing. Patching remains the strongest fix.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.