Four Ancient Linux Kernel Flaws Get Root Exploits
Four severe vulnerabilities deeply embedded within the Linux kernel, lurking undetected for 10 to 21 years, finally have functional public exploits. Consequently, these critical flaws allow attackers to achieve root privilege escalation. These vulnerabilities primarily target various network subsystems. Alarmingly, under specific configurations, one of these flaws theoretically transitions from a local attack vector to complete remote system compromise.
The LPE Quartet Vulnerabilities Explained
Security researcher Asim Manizada successfully identified and named these vulnerabilities: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). Manizada responsibly disclosed these critical errors to the Linux security team in mid-July. Subsequently, developers gradually integrated the necessary patches into stable kernel branches. For an in-depth technical analysis of these findings, you can explore Manizada’s comprehensive blog post detailing the LPE quartet vulnerabilities in the Linux kernel.
The DirtyAH6 flaw hides within the Authentication Header processing mechanism for IPv6. An incorrect segments_left value forces the kernel to calculate a pointer far beyond the designated buffer. This triggers an out-of-bounds memmove operation. The functional Proof-of-Concept (PoC) intentionally corrupts network buffer structures. Then, it utilizes a technique resembling Dirty Frag to manipulate memory data and spawn a root shell via the ‘su’ command.
Conversely, TUNderflow connects to virtual TUN/TAP network devices. It stems from an inaccurate calculation of the available space preceding network packet data. An excessively large headroom value triggers a catastrophic integer overflow. Consequently, packet processing escapes the allocated memory boundaries entirely.
Meanwhile, PPPoEject exploits an entirely different memory management error. The PPPoE code erroneously continues referencing an obsolete pointer within the network buffer immediately after memory reallocation. This sequence effectively results in a dangerous use-after-free vulnerability.
Finally, DiagSpill resides deep within the SCTP protocol. The host address counter occupies a restrictive 16-bit field. Tragically, this counter resets to zero upon adding the 65,536th transport. Following this overflow, the kernel mistakenly reserves a tiny Netlink response buffer. However, it stubbornly continues copying the entire list, ultimately writing approximately 8MB far beyond the buffer’s limitations.
Exploitation Nuances and Remote Potential
You should not consider these published exploits a universal “root button” for every Linux distribution. All four flaws fundamentally rely on complex memory corruption. Therefore, attackers must meticulously tailor their PoC to the specific kernel version, processor architecture, and exact memory layout. The exploitation chains for DirtyAH6, TUNderflow, and PPPoEject require access to unprivileged user namespaces. However, DiagSpill stands apart. If SCTP and sctp_diag remain accessible, the exploit requires neither user namespaces nor specialized capabilities. During Manizada’s extensive testing, robust security modules like SELinux and AppArmor failed to halt the exploitation once the prerequisite conditions were met.
Some of these vulnerabilities also harbor limited remote attack potential. Specifically, DirtyAH6 can induce a remote crash on a Linux machine functioning as an IPv6 router adding AH in transport mode. Manizada even achieved remote root access in his controlled laboratory environment following meticulous memory preparation. Nevertheless, he characterized fully remote exploitation in the wild as exceptionally difficult.
Essential Mitigation and Protection Strategies
The primary defense against this LPE quartet is immediately updating your kernel. The earliest stable versions incorporating all four vital patches are Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Disabling unprivileged user namespaces effectively blocks standard users from exploiting the first three flaws. However, this mitigation completely fails to protect against DiagSpill. If your system does not require AH6, TUN, PPPoE, or SCTP functionality, administrators should disable these features entirely. Ultimately, the extreme age of these four flaws vividly demonstrates why we can never automatically assume legacy kernel code remains secure simply because it has existed for decades.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
