Full Report
A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access on a machine. Kernel maintainers have fixed all four over the past few weeks, so a system running an up-to-date kernel is not affected. But the exploit code is now public, and any machine still running an older kernel should be updated. The flaws
Analysis Summary
# Vulnerability: Linux Kernel LPE Quartet (DirtyAH6, TUNderflow, PPPoEject, DiagSpill)
## CVE Details
- **CVE ID:**
- CVE-2026-80844 (DirtyAH6)
- CVE-2026-81000 (TUNderflow)
- CVE-2026-68121 (PPPoEject)
- CVE-2026-74469 (DiagSpill)
- **CVSS Score:** Not explicitly listed in the text, but the impact is characterized as Local Privilege Escalation (LPE) to Root.
- **CWE:** Memory safety vulnerabilities (Corruption/Overflow).
## Affected Systems
- **Products:** Linux Kernel.
- **Versions:** Vulnerable versions include major branches such as 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.2 prior to the patch releases.
- **Configurations:**
- **DirtyAH6, TUNderflow, PPPoEject:** Typically requires unprivileged user namespaces to be enabled (default on many distributions).
- **DiagSpill:** Requires the SCTP networking module to be available.
- **DirtyAH6 (Remote Crash):** Host must route IPv6 and add Authentication Headers in transport mode.
## Vulnerability Description
This quartet consists of four distinct memory-safety flaws located within the Linux kernel’s networking stack, some dating back over 20 years.
- **DirtyAH6:** A flaw in IPsec handling of IPv6 Authentication Headers where routing-header fields are trusted without verification.
- **TUNderflow:** A memory corruption issue in TUN/TAP virtual network devices.
- **PPPoEject:** A vulnerability within the Point-to-Point Protocol over Ethernet (PPPoE) implementation.
- **DiagSpill:** A flaw in the SCTP `sctp_diag` module.
## Exploitation
- **Status:** PoC available. Working exploit code has been publicly released by researcher Asim Manizada. No reported real-world attacks as of September 2026.
- **Complexity:** Medium (Exploits are tuned to specific kernel builds and may cause system crashes).
- **Attack Vector:** Local (Primary vector for Root escalation); Remote (Limited to DoS/Crash in specific configurations).
## Impact
- **Confidentiality:** High (Full system access via Root shell).
- **Integrity:** High (Ability to modify any system file/kernel memory).
- **Availability:** High (Exploits can cause kernel panics/crashes).
## Remediation
### Patches
Update to the following stable Linux kernel versions (or later) or the equivalent backported version from your distribution vendor:
- 5.10.270
- 5.15.221
- 6.1.188
- 6.6.157
- 6.12.109
- 6.18.50
- 7.2.4
### Workarounds
- **Disable Unprivileged User Namespaces:** This mitigates the ordinary-user path for DirtyAH6, TUNderflow, and PPPoEject.
- **Disable Affected Modules:** Turn off AH6, TUN/TAP, PPPoE, and SCTP if they are not required for system operation.
## Detection
- **Indicators of Compromise:** Unusual kernel crashes (Oops/Panics), unexpected elevation of privileges for low-privileged accounts, or unauthorized use of network-admin commands within user namespaces.
- **Detection methods and tools:** Monitor system logs for `sctp_diag` errors or IPsec header anomalies. Audit systems for the presence of the publicly released exploit source code.
## References
- **Researcher Write-up:** hxxps[://]heyitsas[.]im/posts/lpe-quartet/
- **Original News Source:** hxxps[://]thehackernews[.]com/2026/09/public-exploits-released-for-four-linux.html