Four Critical Linux Kernel Privilege Escalation Flaws Let Attackers Gain Root Access

Key Takeaways

• Four critical privilege escalation flaws, collectively dubbed the “LPE Quartet,” have been discovered in the Linux kernel.
• These vulnerabilities affect various networking components, including IPv6, TUN/TAP, PPPoE, and SCTP, potentially allowing local attackers to gain root access.
• Patches are now available in stable kernel branches (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4) and administrators are urged to update immediately.

Major Linux Kernel Flaws Grant Root Privileges

Four severe vulnerabilities within the Linux kernel’s networking stack have been publicly disclosed, presenting a significant risk of local privilege escalation to root access. These flaws, collectively known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, target long-standing code and have now received official upstream fixes.

Each vulnerability has been assigned a unique CVE identifier: CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469, respectively.

DirtyAH6 (CVE-2026-80844)

The DirtyAH6 vulnerability primarily affects the IPv6 Authentication Header (AH) processing within the Linux IPsec/XFRM framework. The core issue arises when the kernel processes malformed IPv6 routing-header values without adequately validating the segments_left field. This oversight can cause an internal pointer to move beyond its designated memory boundary, leading to an out-of-bounds memory operation.

While primarily a local privilege escalation vector requiring an attacker to create or control specific network namespaces, systems configured as IPv6 routers or gateways utilizing AH in transport mode could face a remote denial-of-service risk under very specific conditions. Although a laboratory demonstration achieved remote root access through memory grooming, the researcher noted that a purely remote attack would be exceptionally difficult to execute.

TUNderflow (CVE-2026-81000)

Identified as TUNderflow, CVE-2026-81000 resides in the TUN/TAP virtual network-device subsystem. A malicious local user can exploit oversized receive-headroom values transmitted through particular network device configurations, including those involving Open vSwitch paths. This manipulation triggers an integer underflow during socket-buffer allocation, potentially causing packet data to be written outside its allocated memory region, thereby enabling out-of-bounds reads and writes.

PPPoEject (CVE-2026-68121)

PPPoEject, or CVE-2026-68121, is a use-after-free vulnerability impacting the Linux PPP over Ethernet (PPPoE) implementation. The flaw occurs in the pppoe_sendmsg() function, which maintains a pointer to a PPPoE header while invoking a lower-level device-header function. This callback can reallocate the socket buffer, consequently invalidating the original pointer. Subsequent writes through this now-stale pointer can corrupt freed kernel memory. The upstream patch resolves this by ensuring the header pointer is reloaded after the device-header creation.

DiagSpill (CVE-2026-74469)

DiagSpill, tracked as CVE-2026-74469, is found in the Stream Control Transmission Protocol (SCTP) diagnostic reporting mechanism, specifically through sock_diag. An SCTP association can support up to 65,536 peer transports, yet the associated counter is only 16 bits wide. When this count reaches its maximum, it wraps around to zero. This causes the diagnostic code to reserve insufficient memory before attempting to copy peer information, resulting in an overwrite that can extend significantly beyond the intended Netlink response buffer.

Unlike the other three vulnerabilities, DiagSpill does not necessitate unprivileged user namespaces or special Linux capabilities, provided that SCTP and sctp_diag support are enabled. Furthermore, remote crash conditions might arise if SCTP address-configuration features are active, though these features are disabled by default.

Researcher Asim Viladi Oglu Manizada reported the issues to the Linux kernel security team in mid-July. Patches were subsequently released through a coordinated disclosure process and are now integrated into supported stable kernel branches.

What You Should Do

• Apply Kernel Updates Immediately: Administrators should prioritize upgrading to a kernel release that incorporates all four fixes. The first stable versions addressing the complete set of vulnerabilities are Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.
• Restrict Unprivileged User Namespaces: Where immediate patching is not feasible, organizations should restrict unprivileged user namespaces. However, note that disabling user namespaces does not mitigate DiagSpill and is not a substitute for applying vendor kernel updates.
• Disable Unused Functionality: Consider disabling any unused AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag functionality to reduce the attack surface.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.