Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access

Four newly disclosed Linux kernel vulnerabilities could allow local attackers to corrupt kernel memory and escalate privileges to root on affected systems.

The flaws, named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affect long-standing networking code and have now received upstream fixes. The vulnerabilities are tracked as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469.

DirtyAH6, tracked as CVE-2026-80844, affects IPv6 Authentication Header processing in Linux IPsec/XFRM code. The issue occurs when the kernel handles malformed IPv6 routing-header values without correctly validating the segments_left field. This can move an internal pointer outside the intended memory area and trigger an out-of-bounds memory operation.

The bug is primarily a local privilege escalation issue when an attacker can create or control suitable network namespaces. However, systems acting as IPv6 routers or gateways that use AH in transport mode could face remote denial-of-service risk under narrow conditions.

The researcher demonstrated remote root access in a laboratory setup with memory grooming, though achieving that through a remote-only attack was described as highly difficult.

TUNderflow, identified as CVE-2026-81000, exists in the TUN/TAP virtual network-device subsystem. A malicious local user can abuse oversized receive-headroom values passed through specific network-device configurations, including Open vSwitch paths.

The error causes an integer underflow during socket-buffer allocation, potentially placing packet data outside its allocated memory area and enabling out-of-bounds reads and writes.

PPPoEject, or CVE-2026-68121, is a use-after-free flaw in the Linux PPP over Ethernet implementation. The pppoe_sendmsg() function keeps a pointer to a PPPoE header while calling a lower-level device-header function.

That callback can reallocate the socket buffer and invalidate the original pointer. Later writes through the stale pointer may corrupt freed kernel memory. The upstream patch reloads the header pointer after device-header creation.

Linux Kernel Privilege Escalation Flaws

DiagSpill, tracked as CVE-2026-74469, affects SCTP diagnostic reporting through sock_diag. An SCTP association can contain up to 65,536 peer transports, while the related counter is only 16 bits wide.

When the count reaches the limit, it wraps to zero, causing the diagnostic code to reserve insufficient space before copying peer information. The resulting overwrite can extend far beyond the intended Netlink response buffer.

Unlike the first three issues, DiagSpill does not require unprivileged user namespaces or special Linux capabilities when SCTP and sctp_diag support are available.

Remote crash conditions may also exist if SCTP address-configuration features are enabled. However, those features are turned off by default.

Researcher Asim Viladi Oglu Manizada reported the issues to the Linux kernel security team in mid-July. Patches were released through coordinated disclosure and are now available in supported stable kernel branches.

Administrators should upgrade to a kernel release containing all four fixes. The first stable versions that address the complete set are Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.

Where immediate patching is not possible, organizations should restrict unprivileged user namespaces and disable unused AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag functionality. However, turning off user namespaces does not mitigate DiagSpill and is not a substitute for applying vendor kernel updates.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access appeared first on Cyber Security News.