Four Local Root Vulnerabilities in the Linux Kernel: DirtyAH6, TUNderflow, PPPoEject and DiagSpill

After the embargo agreed with linux-distros expired, researcher Asim Manizada published details of four local privilege escalation (LPE) vulnerabilities in the Linux kernel. All of them were reported to security@kernel.org and the relevant maintainers in mid-July, and the underlying bugs have existed, by the author's estimate, for between 10 and 21 years.

The vulnerabilities were given memorable names and identifiers: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) and DiagSpill (CVE-2026-74469). A working PoC was prepared for each, taking a regular user all the way to code execution with root privileges.

How they work

The first three require either unprivileged user/network namespaces or specific privileges (CAP_NET_ADMIN, CAP_NET_RAW) in a network namespace controlled by the attacker. DiagSpill stands out: it needs neither namespaces nor special CAPs — it is enough for SCTP and sctp_diag to be available on the system.

The nature of the bugs is classic for the network stack: DirtyAH6 stems from an incorrect check of the segments_left field in the IPv6 routing header, which leads to an out-of-bounds access in memmove(). TUNderflow causes an overflow when computing the headroom for a TUN device. PPPoEject uses a dangling pointer to an skb region freed inside dev_hard_header(). DiagSpill exploits an overflow of SCTP's 16-bit transport counter: at 65,536 transports it wraps to zero, and sctp_diag spills about 8 MiB of data beyond the Netlink response.

The author stresses that the preconditions listed are not exotic — the corresponding modules and code paths are present in ordinary distribution builds. In his tests, AppArmor and SELinux did not block the exploits. All four bugs can also corrupt the host kernel from within a container, which theoretically opens a path to escaping isolation, although Manizada did not carry that scenario through to the end.

Remote vector and defenses

DirtyAH6 and DiagSpill are reachable remotely under certain conditions. If a system acts as an IPv6 router and adds AH in transport mode, DirtyAH6 turns into at least a remote denial of service; in lab conditions the author managed to drive it to remote root, but a purely remote implementation looks extremely difficult. DiagSpill, with ASCONF/ADD-IP enabled (disabled by default), threatens a remote crash but not full takeover.

The fixes have already spread across the stable branches. The first releases containing all four patches were 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. As temporary measures, the author advises disabling unprivileged user namespaces, as well as the unneeded AH6, TUN, PPPoE and SCTP/sctp_diag modules.

Source: Lobsters