Four Linux Kernel Flaws Put Unpatched Systems at Risk of Root Access

September 19, 2026

Security researchers have released working exploit code for four Linux kernel vulnerabilities that can allow a local, unprivileged user to gain root access on affected systems.

The vulnerabilities, tracked as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affect different components of the Linux kernel's networking stack. Kernel maintainers have already released fixes for all four vulnerabilities, but systems running older and vulnerable kernel versions remain exposed.

The exploit code was publicly released on September 18, 2026, by security researcher Asim Manizada, who discovered the vulnerabilities and reported them to the Linux kernel security team in mid-July. The disclosure followed a coordinated period that allowed Linux distributions to release security fixes before the exploits became public.

There are currently no reports in the supplied research indicating that these vulnerabilities are being exploited in real-world attacks.

Four Vulnerabilities Can Lead to Root Access

The four vulnerabilities affect different areas of Linux networking code.

CVE-2026-80844, known as DirtyAH6, affects the Linux IPsec Authentication Header implementation for IPv6. The vulnerability can result in memory corruption when specially crafted routing information is processed.

CVE-2026-81000, known as TUNderflow, affects TUN and TAP virtual network devices. An integer calculation issue can cause packet data to be written outside the intended memory buffer.

CVE-2026-68121, known as PPPoEject, affects the Linux implementation of PPP over Ethernet. The flaw involves a use-after-free condition that can allow memory to be accessed after it has been released.

CVE-2026-74469, known as DiagSpill, affects SCTP diagnostic functionality. A counter overflow can cause the kernel to allocate insufficient memory before copying a large amount of data, resulting in memory corruption.

According to the researcher's analysis, the vulnerabilities can be used to corrupt kernel memory and ultimately obtain root privileges from a local user account.

Unprivileged User Namespaces Increase Exposure

Three of the four vulnerabilities can be exploited by an ordinary local user when unprivileged user namespaces are enabled.

Linux user namespaces allow ordinary users to obtain root-like privileges inside an isolated namespace. The feature is enabled by default on many Linux distributions and can provide attackers with the capabilities needed to reach vulnerable networking functionality.

The three vulnerabilities associated with this requirement are DirtyAH6, TUNderflow, and PPPoEject.

DiagSpill differs from the other three vulnerabilities because it does not require unprivileged user namespaces or additional privileges when the affected SCTP functionality is available.

Remote Exploitation Is Limited

The vulnerabilities are primarily local privilege escalation issues.

The researcher also demonstrated that DirtyAH6 and DiagSpill can be triggered remotely in specific configurations, but the remote scenarios mainly result in system crashes rather than straightforward remote root access.

DirtyAH6 can affect systems acting as IPv6 routers or gateways when IPsec Authentication Headers are used in transport mode.

The researcher demonstrated a remote root scenario for DirtyAH6 in a controlled laboratory environment after first manipulating the target's memory layout. However, the research noted that achieving the same result remotely without prior memory preparation would be extremely difficult.

For DiagSpill, certain non-default SCTP options must be enabled for the remote crash condition. The researcher did not identify a practical path to remote root access through this vulnerability.

Public Exploit Code Raises Risk for Older Systems

Although the vulnerabilities were patched before the exploit release, the availability of working exploit code increases the risk for systems that have not yet been updated.

Local privilege escalation vulnerabilities can be particularly important on shared servers, development systems, hosting environments and other infrastructure where an attacker may first obtain a low-privileged account and then attempt to escalate privileges.

The researcher also noted that similar vulnerabilities could theoretically be useful for container escape scenarios, although no complete container escape exploit was developed as part of the research.

Fixed Linux Kernel Versions

The first stable Linux kernel releases containing fixes for all four vulnerabilities include:

  • Linux 5.10.270
  • Linux 5.15.221
  • Linux 6.1.188
  • Linux 6.6.157
  • Linux 6.12.109
  • Linux 6.18.50
  • Linux 7.2.4

Administrators should not rely solely on these upstream version numbers because distributions such as Debian, Ubuntu, Red Hat and SUSE maintain their own kernel packages and versioning systems.

Organizations should check their Linux distribution's security advisories and confirm that the installed kernel contains fixes for all four vulnerabilities.

Linux administrators should prioritize updating affected systems to a kernel containing fixes for all four vulnerabilities.

If immediate patching is not possible, administrators can consider reducing exposure by disabling unprivileged user namespaces. This can prevent the ordinary-user exploitation path described for DirtyAH6, TUNderflow and PPPoEject.

Administrators can also disable unused networking functionality associated with the vulnerabilities, including:

  • AH6 and IPsec functionality
  • TUN and TAP
  • PPPoE
  • SCTP

However, these mitigations should not be considered a replacement for applying security updates.

Systems running containers, multi-user environments or internet-facing services should receive particular attention because privilege escalation vulnerabilities can become more significant after an attacker gains an initial foothold.

Vulnerabilities Found Through AI-Assisted Research

Manizada said the vulnerabilities were discovered using an AI-assisted research process designed to map kernel memory handling and reason about memory layouts.

The Linux kernel fix for DirtyAH6 includes an "Assisted-by" entry crediting the researcher's custom AI tooling.

The findings are part of a growing number of Linux kernel security issues discovered with assistance from large language models and other AI-based techniques.

The researcher previously disclosed another Linux kernel privilege escalation vulnerability known as OVSwrap.

What Organizations Should Check

Security teams should identify systems running vulnerable kernel versions and verify that security patches have been applied.

They should also review whether unprivileged user namespaces are enabled, determine whether TUN/TAP, PPPoE, AH6 or SCTP functionality is required, and examine systems where untrusted users can obtain local accounts.

Because working exploit code is now publicly available, organizations should treat unpatched systems as higher priority for remediation.

At the time of the disclosure, there were no reports in the supplied research confirming that DirtyAH6, TUNderflow, PPPoEject or DiagSpill had been used in active attacks.

For defenders, the primary mitigation remains straightforward: update the Linux kernel and verify that the installed distribution package contains all four fixes.