Science1 publisher3 min readPublished
Four newly disclosed exploits turn Linux kernel bugs aged 10 to 21 years into root
A researcher posting to oss-security reports that all four proof-of-concept exploits gave an unprivileged local user root code execution on the test targets, against kernel code that has been in the tree for between 10 and 21 years.
The Scientist · Science desk
What happened
- A researcher posting as manizada disclosed four Linux kernel local root vulnerabilities to the oss-security list on September 18, once the embargo agreed with linux-distros had expired.
- The four are DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) and DiagSpill (CVE-2026-74469), each with a published proof-of-concept exploit.
- Three of the four need unprivileged user namespaces or specific capabilities to reach the corruption bug, while DiagSpill needs only that SCTP and its sctp_diag module are supported.
- The first upstream stable releases carrying all four fixes are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4, seven series in all.
- In the author's testing, AppArmor and SELinux did not block the exploits, the exception being Ubuntu configurations that block unprivileged user namespaces outright.
Compiled by The ScientistSomething wrong?How this is made
Why it matters
- exposure A container tenant holding no special capabilities can corrupt the host kernel through DiagSpill wherever SCTP and sctp_diag are available, and whether that becomes a full escape is untested.
- constraint Disabling unprivileged user namespaces, the lever Ubuntu's AppArmor policy already pulls, covers three of these four and leaves the SCTP path open.
- decision Fleets that cannot reboot onto a patched stable base now have to choose which of AH6/XFRM, TUN, PPPoE and SCTP they are willing to keep loadable.
- cost Triage runs at four questions per host, one per module path, and the summary prerequisites describe only the corruption bugs, so the exploit-level requirements have to be read out of the PoC READMEs.
DirtyAH6 is an unchecked count. According to the disclosure, `ipv6_rearrange_rthdr()` read the number of addresses in an IPv6 routing header from the header length field, then moved an address pointer by segments minus segments_left without checking that segments_left was no greater than segments [21]. A raw IPv6 packet built with HDRINCL, hdrlen=2 and segments_left=255 moved that pointer back 4,064 bytes and passed 4,064 as the length to `memmove()` [21]. The 4,064 is 254 IPv6 addresses at 16 bytes each, which is the 255 segments the packet claimed minus the one address the header length accounted for [3].
The prerequisites listed in the post are for the corruption bugs alone; the full exploit requirements, including further kernel modules and userspace tooling, sit in the proof-of-concept READMEs [10]. A config that can reach the faulty code is not automatically a config where the published PoC produces a root shell. What the post does report is that all four PoCs gave unprivileged local user to root code execution on their targets [9].
Three of the four need either unprivileged user namespaces or capabilities over an attacker-controlled network namespace: CAP_NET_ADMIN and CAP_NET_RAW for DirtyAH6 [11], CAP_NET_ADMIN for TUNderflow [12] and for PPPoEject [13]. DiagSpill needs SCTP and sctp_diag support and no capabilities at all [14]. The researcher, who posted as manizada, wrote that "these pre-reqs are not exotic" and that they "cover standard modules/paths commonly available on regular distro kernels" [15].
From inside a container, all four bugs can corrupt the host kernel, the first three given the appropriate capabilities without creating new user namespaces, DiagSpill given only SCTP and sctp_diag [17]. "This could theoretically enable a container escape, though I didn't pursue this angle with the PoCs," manizada wrote [18].
The remote picture is narrower than the local one. A host acting as an IPv6 router or gateway that adds AH in transport mode can be crashed through DirtyAH6, and with on-target memory grooming the author reached remote root in a lab, while remote-only grooming to root is described in the post as extremely difficult [19]. DiagSpill's remote path requires ASCONF/ADD-IP enabled together with SCTP-AUTH or `net.sctp.addip_noauth_enable=1`, all off by default, plus something on the target such as `ss` issuing the sock_diag request that triggers the overwrite [20]. Of that case, manizada wrote: "I do not see a path to full remote root, even assuming perfect remote memory grooming" [20].
Each fix has a named commit, so a build can be checked against the tree directly: "xfrm: ah6: validate routing header segments_left" for DirtyAH6, "net: tun: bound receive headroom" for TUNderflow, "pppoe: reload header pointer after dev_hard_header()" for PPPoEject, and "sctp: prevent peer transport count overflow" for DiagSpill [7]. The bugs went to [email protected] and the relevant maintainers in mid-July [3], and the list post came on September 18, roughly nine weeks later [2].
What to watch
- Whether distributions that still permit unprivileged user namespaces change that default, given three of the four exploits depend on them.
- Whether anyone reproduces the PoCs independently, or demonstrates the container escape the author says was not pursued.
- Whether container hosts begin blocklisting sctp and sctp_diag autoload, the only prerequisite DiagSpill needs.