Four Long-Standing Linux Kernel Local Root Flaws Disclosed

Security researcher Asim Manizada has publicly disclosed four Linux kernel local privilege escalation bugs after the embargo with linux-distros expired. The flaws — DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469) — have existed in the kernel for 10 to 21 years, and working proof-of-concept exploits achieving unprivileged-user-to-root code execution are now published on GitHub.

Three of the bugs require unprivileged user/network namespaces or specific capabilities (CAP_NET_ADMIN/CAP_NET_RAW) to exploit, while DiagSpill needs no special privileges at all — just SCTP and sctp_diag support commonly enabled on distro kernels. Root causes include missing routing-header validation in AH6/XFRM (DirtyAH6), a receive-headroom underflow in TUN (TUNderflow), a stale pointer left over after skb head reallocation during dev_hard_header() (PPPoEject), and a 16-bit transport_count overflow in SCTP that spills memory via sctp_diag (DiagSpill). Neither AppArmor nor SELinux blocked the exploits in testing, and all four bugs can also corrupt the host kernel from within a container.

DirtyAH6 and DiagSpill are additionally reachable remotely under narrow circumstances, with DirtyAH6 theoretically — though very difficultly — groomable to remote root. Fixes have already landed across stable trees, with the first releases carrying all four patches being 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Engineers running affected kernels should prioritize updating; disabling unprivileged user namespaces and unused AH6, TUN, PPPoE, or SCTP modules offers partial short-term mitigation.