A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access on a machine.
Kernel maintainers have fixed all four over the past few weeks, so a system running an up-to-date kernel is not affected. But the exploit code is now public, and any machine still running an older kernel should be updated.
The flaws are called DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. Researcher Asim Manizada found them and reported them to the Linux kernel security team in mid-July.
He published a technical write-up with working exploits on September 18, after a coordinated hold with Linux distributions so the fixes could be released first.
So far, there are no reports of the four being used in real-world attacks. The exploits are Manizada’s own, are tuned to specific kernel builds, and can crash a machine, so they are meant for isolated test systems.
Still, public exploit code raises the risk on shared systems. Local privilege escalation matters most where an attacker already has some access, such as a low-privileged account on a multi-user server, and wants to take full control.
What’s Affected
Three of the four flaws can be reached by an ordinary user only when unprivileged user namespaces are enabled. User namespaces are a Linux feature that lets a normal user act as root inside a private sandbox. Many distributions enable them by default, which is how an attacker gains the network privileges the exploits require.
The fourth flaw, DiagSpill, is the exception. It requires no user namespaces or special privileges, as long as the system has the SCTP networking module available.
| Flaw | CVE | Kernel area | Local prerequisite | Reachable remotely? |
|---|---|---|---|---|
| DirtyAH6 | CVE-2026-80844 | IPsec AH6 (IPv6) | Unprivileged user namespaces | Crash only, and only if the host routes IPv6 and adds an Authentication Header in transport mode |
| TUNderflow | CVE-2026-81000 | TUN/TAP virtual network devices | Unprivileged user namespaces | No |
| PPPoEject | CVE-2026-68121 | PPPoE | Unprivileged user namespaces | No |
| DiagSpill | CVE-2026-74469 | SCTP (sctp_diag) | None | Crash only, and only with non-default SCTP options turned on |
Manizada also found that two of the flaws, DirtyAH6 and DiagSpill, can be triggered over the network, but only in narrow cases and mainly to cause the system to crash.
DirtyAH6 can crash a host that acts as an IPv6 router or gateway and adds an IPsec Authentication Header in transport mode. DiagSpill can crash a host only when certain SCTP options, which are off by default, are switched on.
Manizada reached remote root with DirtyAH6 only in his own lab, and only by shaping memory on the target first. Doing that from a remote position alone, he wrote, “looks extremely difficult,” though he did not rule it out. For DiagSpill, he said he sees no path to remote root at all, even with perfect memory shaping.
He also said the flaws could, in theory, allow an attacker to escape a container, but he did not build one.
What To Do
Update to a kernel that carries all four fixes. The first stable kernel releases with the complete set are:
- 5.10.270
- 5.15.221
- 6.1.188
- 6.6.157
- 6.12.109
- 6.18.50
- 7.2.4
These are the version numbers from the main Linux kernel project. Most people run a kernel from a distribution instead, such as Debian, Ubuntu, Red Hat, or SUSE, which uses its own version numbers and adds these fixes on its own schedule. Check your distribution’s security advisory to confirm it has shipped an update that includes all four, rather than matching the numbers above.
If you cannot patch right away, two steps reduce the risk:
- Turn off unprivileged user namespaces. This closes the ordinary-user path to DirtyAH6, TUNderflow, and PPPoEject. It does not stop DiagSpill, and it does not stop a container or process that already has network-admin privileges.
- Turn off the affected features if you do not use them: AH6, TUN/TAP, PPPoE, and SCTP.
Manizada recommends patching rather than turning off features, because other paths to the same flaws may exist.
How the Bugs Work
All four are memory-safety bugs in different parts of the kernel’s networking code. Each one allows an attacker to corrupt kernel memory, which Manizada then used to gain a root shell. The underlying mistakes are old, ranging from 10 to 21 years.
- DirtyAH6 is in the IPsec code that handles the IPv6 Authentication Header. The code trusted a routing-header field without verifying it against the number of addresses present, so a crafted packet caused an internal pointer to move far out of bounds and write past the buffer.
- TUNderflow is in the TUN and TAP virtual network devices. A single value was used both as spare space and as a size, and an oversized value passed in through Open vSwitch caused the size calculation to wrap around, so packet data landed outside its buffer.
- PPPoEject is in the code for PPP over Ethernet. It kept a pointer into a network buffer while calling a device routine that could free and move that buffer, and the later writes then used freed memory, a bug known as a use-after-free.
- DiagSpill is in the reporting code for SCTP. A counter that tracks connection endpoints is only 16 bits wide, so the 65,536th endpoint wrapped it back to zero. The reporting code then set aside no space but copied the full list, writing about 8 MiB of data past the end of its buffer.
An AI-Assisted Run
Manizada said he found the four flaws with an AI-assisted process that builds a map of how the kernel handles memory and reasons about its layout. The kernel’s fix for DirtyAH6 records this: the commit includes an “Assisted-by” line that credits his custom AI tooling.
This is the latest in a run of Linux kernel privilege escalation flaws disclosed through 2026, several of them found with help from large language models. Manizada disclosed a similar Open vSwitch flaw, OVSwrap, in July.
One of the new exploits also reuses a technique from Dirty Frag, another Linux kernel root flaw disclosed in May by a different researcher. In his write-up, Manizada said this batch likely ends the public phase of his AI-assisted bug hunting.
