Public Exploits Released for 4 Linux Flaws Enabling Local Root

Executive Summary

Security researcher Asim Manizada has published comprehensive technical disclosures and functional local privilege escalation (LPE) proof-of-concept (PoC) exploits targeting four distinct memory-safety vulnerabilities within the Linux kernel networking subsystem. Dubbed the "LPE Quartet"—comprising DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469)—the underlying flaws have resided silently within the upstream Linux kernel codebase for between 10 and 21 years.

All four vulnerabilities permit unprivileged local users or compromised multi-tenant workloads to corrupt kernel memory and obtain full root privileges (UID 0). While three of the vulnerabilities (DirtyAH6, TUNderflow, and PPPoEject) typically leverage unprivileged user namespaces to gain network administrative capabilities, DiagSpill requires zero special capabilities or namespaces, making it universally reachable on any standard Linux host with SCTP support. Furthermore, DirtyAH6 and DiagSpill exhibit remote denial-of-service (crash) potential under specific network routing configurations.

Technical Vulnerability Analysis & Attack Chain

The vulnerabilities were discovered utilizing custom AI-assisted vulnerability research tooling that pairs graph-based semantic tracking of security-relevant kernel objects with geometric memory layout reasoning.

[Unprivileged Local Attacker / Container Process]

│

┌───────────────┼───────────────┬────────────────┐

│ (Userns req) │ (Userns req) │ (Userns req) │ (ZERO Caps Req)

▼ ▼ ▼ ▼

[DirtyAH6] [TUNderflow] [PPPoEject] [DiagSpill]

CVE-2026-80844 CVE-2026-81000 CVE-2026-68121 CVE-2026-74469

(IPsec AH6) (TUN/TAP) (PPPoE) (SCTP sctp_diag)

│ │ │ │

memmove() OOB Headroom Wrap UAF Race on 16-bit Overflow

(-4,064 bytes) (SKB_MAX_HEAD) skb Head (8 MiB Netlink Spill)

│ │ │ │

▼ ▼ ▼ ▼

Overwrites Corrupts Pipe Redirects fd Overwrites Kernel

skb_shared_info Buffer Flags to Fake File Page Tables

│ │ │ │

▼ ▼ ▼ ▼

Overwrites Overwrites Executes Injects

/etc/pam.d/su /etc/pam.d/su commit_creds() /etc/sudoers

(pam_permit) (pam_permit) via Callback Rule

│ │ │ │

└───────────────┴───────┬───────┴────────────────┘

▼

[LOCAL ROOT SHELL / UID 0]

1. DirtyAH6 (CVE-2026-80844) — IPsec AH6 Routing Header OOB Write

• Subsystem: IPsec Authentication Header for IPv6 (net/ipv6/ah6.c, XFRM).
• Root Cause: In ipv6_rearrange_rthdr(), the kernel extracts the address count from hdrlen, then calculates pointer movements using segments - segments_left without validating that segments_left <= segments. Passing a raw IPv6 HDRINCL packet with hdrlen=2 and segments_left=255 forces the address pointer backward by 4,064 bytes, passing a 4,064-byte negative offset into memmove().
• Exploitation: The exploit corrupts skb_shared_info. A subsequent ESP decryption routine writes into a file-backed page cache fragment, replacing pam_rootok.so with pam_permit.so in /etc/pam.d/su, allowing a trivial root shell via su. On IPv6 routers adding AH in transport mode, this can be triggered over the network to crash the host.

2. TUNderflow (CVE-2026-81000) — TUN/TAP Headroom Integer Underflow

• Subsystem: TUN/TAP virtual network device driver (drivers/net/tun.c).
• Root Cause: tun_set_headroom() stores receive headroom in tun->align, while tun_get_user() uses it to calculate packet data allocation. When an Open vSwitch datapath with VXLAN passes an oversized headroom (4,160 bytes) down to a raw TUN port, SKB_MAX_HEAD(4160) underflows. The negative integer wraps into a massive positive size_t, causing tun_alloc_skb() to misplace skb->data 64 bytes beyond the 4,096-byte allocation boundary.
• Exploitation: The PoC arranges file-backed pipe buffers directly adjacent to the out-of-bounds packet. The corrupt packet sets PIPE_BUF_FLAG_CAN_MERGE on the target pipe buffer, allowing arbitrary file overwrites against /etc/pam.d/su to grant root.

3. PPPoEject (CVE-2026-68121) — PPPoE skb Use-After-Free

• Subsystem: PPP over Ethernet (drivers/net/ppp/pppoe.c).
• Root Cause: In pppoe_sendmsg(), the kernel retains a raw pointer into the socket buffer head while invoking dev_hard_header(). If an underlying device routine (such as adding a GRE interface to an empty team/bonding device while blocking payload copying via FUSE) triggers pskb_expand_head(), the original buffer head is freed and reallocated. However, PPPoE retains the stale pointer, writing subsequent headers into freed memory.
• Exploitation: The exploit races active file descriptor (fd) tables into the freed memory slab. The stale PPPoE write redirects an active file descriptor pointer to a forged struct file. Closing the file descriptor executes a controlled kernel function pointer, invoking commit_creds(prepare_kernel_cred(0)) to grant instant root.

4. DiagSpill (CVE-2026-74469) — SCTP Diagnostic Buffer Overflow

• Subsystem: SCTP diagnostics (net/sctp/sctp_diag.c).
• Root Cause: sctp_diag tracks peer transport associations using a 16-bit integer (transport_count). When an association establishes 65,536 transports, the counter overflows back to 0. When dumping diagnostics via Netlink, sctp_diag reserves 0 bytes of payload space but copies all 65,536 transport sockaddr structures, spilling approximately 8 MiB of out-of-bounds data past the allocated Netlink buffer.
• Exploitation (Zero Capabilities Needed): Requires no user namespaces or capabilities. The PoC grooms the 8 MiB spill into kernel page tables, maps physical memory, overwrites the current process's struct cred, appends a root rule to /etc/sudoers, and executes sudo su.

Threat Actor Profile & Campaign Attribution

• Current Threat Status: Disclosed responsibly by independent researcher Asim Manizada; no confirmed malicious in-the-wild exploitation has been observed to date.
• Exploitation Likelihood: High for multi-user servers, enterprise bastion hosts, cloud-hosted virtual machines, and containerized shared clusters. The public release of fully functional root PoCs dramatically accelerates weaponization by initial access brokers and ransomware affiliates.
• Container Breakout Surface: Containers provisioned with CAP_NET_ADMIN or CAP_NET_RAW can trigger DirtyAH6, TUNderflow, and PPPoEject directly against the host kernel, bypassing container isolation boundaries without needing nested user namespaces.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Apply Upstream Kernel Updates: Deploy distribution kernel patches containing the complete fix set. Upstream fixed baseline releases include:
  • Linux 7.2.4 / 7.1.13
  • Linux 6.18.50 / 6.12.109
  • Linux 6.6.157 / 6.1.188
  • Linux 5.15.221 / 5.10.270
• Restrict Unprivileged User Namespaces: If immediate rebooting is not feasible, restrict unprivileged user namespaces to block local exploit primitives for DirtyAH6, TUNderflow, and PPPoEject:

// Temporarily disable unprivileged user namespaces

sudo sysctl -w kernel.unprivileged_userns_clone=0

// Persist across reboots in /etc/sysctl.d/99-disable-userns.conf

echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-disable-userns.conf

sudo sysctl -p /etc/sysctl.d/99-disable-userns.conf

• Blacklist Unused Kernel Modules:

echo -e "blacklist sctp\nblacklist pppoe\nblacklist ah6" | sudo tee /etc/modprobe.d/blacklist-lpe-quartet.conf

2. Network & Perimeter Defenses

• Filter Inbound IPv6 Routing Headers: At perimeter firewalls and routers, block or drop incoming IPv6 packets containing Type 0 or malformed routing extension headers with segments_left > 0.
• Restrict SCTP at Edge Gateways: Ensure SCTP protocol traffic (IP protocol 132) is filtered at perimeter firewalls unless required for telecommunications signaling (e.g., SS7/Diameter backbones).

3. Endpoint Detection & Hunting Query

Auditd Rule: Monitoring Namespace Creation & Module Loading

// Audit unshare and clone syscalls attempting user namespace creation

-a always,exit -F arch=b64 -S unshare -F a0=0x10000000 -k userns_abuse

-a always,exit -F arch=b64 -S clone -F a0&0x10000000 -k userns_abuse

-w /etc/pam.d/su -p wa -k pam_tampering

-w /etc/sudoers -p wa -k sudoers_tampering

Falco Rule: Detecting Privilege Escalation via PAM Overwrites

- rule: Suspicious Modification of PAM Authentication Configuration

desc: Detects unauthorized processes modifying /etc/pam.d/su typical of DirtyAH6 and TUNderflow exploits

condition: open_write and fd.name = "/etc/pam.d/su" and not proc.name in (dpkg, apt, rpm, yum, pacman)

output: "CRITICAL: Potential Linux Kernel LPE exploit modifying /etc/pam.d/su (proc=%proc.name user=%user.name file=%fd.name)"

priority: CRITICAL

tags: [host, container, privilege_escalation, mitre_t1548]