Public exploit code has been released for four critical Linux kernel vulnerabilities tracked as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. Discovered by researcher Asim Manizada, these networking flaws—named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—allow local attackers to corrupt kernel memory and escalate privileges to root.
Decoding the Flaws: DirtyAH6, TUNderflow, PPPoEject, and DiagSpill
The Linux kernel security team has issued upstream patches for all four vulnerabilities following mid-July disclosures. These memory safety issues reside in long-standing networking code. They give unprivileged local users or malicious processes a direct path to root access under specific subsystem configurations.
When the kernel handles malformed IPv6 routing-header values without validating the segments_left field correctly, an internal pointer moves outside its intended memory boundary. This triggers an out-of-bounds memory operation. While primarily a local privilege escalationvector, systems acting as IPv6 routers using AH in transport mode face narrow remote denial-of-service risks.
TUNderflow (CVE-2026-81000) targets the TUN/TAP virtual network-device subsystem. By pushing oversized receive-headroom values through Open vSwitch paths, an attacker forces an integer underflow during socket-buffer allocation. This miscalculation places packet data outside allocated memory, enabling out-of-bounds reads and writes.
PPPoEject (CVE-2026-68121) is a classic use-after-free vulnerability in the Linux PPP over Ethernet implementation. The pppoe_sendmsg() function retains a pointer to a PPPoE header while invoking a lower-level device-header function. Because that callback can reallocate the socket buffer, the original pointer becomes invalid. Subsequent writes corrupt freed kernel memory. Upstream patches resolve this by reloading the header pointer after device-header creation.
DiagSpill (CVE-2026-74469) attacks SCTP diagnostic reporting via sock_diag. An SCTP association accommodates up to 65,536 peer transports, but the corresponding counter spans only 16 bits. Once the count hits its ceiling, it wraps to zero. Consequently, the diagnostic code reserves insufficient space before copying peer details, causing an extensive overwrite of the Netlink response buffer.
Mitigation Paths and the AI-Driven Discovery Trend
Most of these vulnerabilities require unprivileged user namespaces to be enabled for local exploitation. User namespaces allow regular users to operate as root inside a confined environment. However, DiagSpill stands apart. It requires neither user namespaces nor special capabilities, provided the system loads the SCTP networking module.
The commit fixing DirtyAH6 explicitly acknowledges Manizada’s custom AI tooling.
- Linux 5.10: Upgrade to version 5.10.270
- Linux 5.15: Upgrade to version 5.15.221
- Linux 6.1: Upgrade to version 6.1.188
- Linux 6.6: Upgrade to version 6.6.157
- Linux 6.12: Upgrade to version 6.12.109
- Linux 6.18: Upgrade to version 6.18.50
- Linux 7.2: Upgrade to version 7.2.4
Enterprise Remediation and Interim Hardening
Administrators running downstream distributions such as Debian, Ubuntu, Red Hat, or SUSE must check vendor-specific security advisories to verify that applied kernel builds incorporate all four fixes. Upstream stable releases containing the complete patch set are listed above.
When immediate kernel patching is impossible, organizations can deploy interim defensive measures. Disabling unprivileged user namespaces neutralizes three of the four vectors. Turning off unused networking features—specifically AH6, TUN/TAP, PPPoE, and SCTP—reduces the attack surface. However, Manizada strongly recommends patching over feature deactivation, as alternate code pathways to the vulnerabilities may remain active.
