Linux LPE Quartet: DirtyAH6, TUNderflow, PPPoEject, DiagSpill — Patch Beyond Monday’s KEV

Monday’s kernel KEV reboot was not the whole Linux story. On September 18, researcher Asim Manizada published four more local-root memory bugs with different CVEs. The fix is the same: update the kernel again.

What happened

Alongside (and distinct from) CISA’s September 18 KEV trio, a coordinated disclosure dropped four Linux local privilege escalation bugs with working PoCs:

DirtyAH6 (CVE-2026-80844) — IPv6 AH6/XFRM routing-header segments_left not validated before memmove; OOB access. In lab conditions, remotely groomable toward root when the target is an IPv6 AH gateway.
TUNderflow (CVE-2026-81000) — TUN/TAP headroom underflow via oversized ndo_set_rx_headroom propagation (e.g., Open vSwitch paths).
PPPoEject (CVE-2026-68121) — Use-after-free / stale pointer when pppoe_sendmsg keeps a pointer across dev_hard_header reallocation.
DiagSpill (CVE-2026-74469) — SCTP transport_count 16-bit wrap lets sctp_diag spill ~8 MiB past a Netlink response. No unprivileged user-namespace requirement.

The first three LPE PoCs need unprivileged user namespaces (or equivalent CAPs in a container). DiagSpill does not. Upstream stable fixes landed across 5.10 through 7.2 trains; first releases carrying all four include 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Why it matters

You may have already rebooted for Monday’s KEV trio and still be vulnerable to this quartet. Local root turns a low-privilege foothold into full control of the host. DiagSpill in particular is reachable without the usual “just disable user namespaces” shortcut. Container hosts and multi-tenant Linux remain the high-value targets.

What to do first

Confirm whether yesterday’s kernel update also covers these four CVEs; if not, take another vendor kernel package and reboot (or verified live-patch).
Prefer builds at or newer than the “all four fixed” train for your series.
Where patching lags: disable unprivileged user namespaces (mitigates ordinary-user path for the first three — not DiagSpill); consider disabling unused AH6/XFRM, TUN, PPPoE, or SCTP/sctp_diag.
Prioritize multi-tenant, CI runner, and container hosts.

Details

Name	CVE	Subsystem	Notes
DirtyAH6	CVE-2026-80844	IPv6 AH6 / XFRM	OOB memmove; possible remote DoS/root class on AH gateways
TUNderflow	CVE-2026-81000	TUN/TAP headroom	Underflow → OOB SKB access
PPPoEject	CVE-2026-68121	PPPoE send path	Stale pointer after head realloc
DiagSpill	CVE-2026-74469	SCTP sock_diag	16-bit transport_count wrap; no userns needed

Disclosure: 2026-09-18 (embargo lift)
KEV: Not listed (separate from CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964)

Hunt / verify

uname -r / package version against vendor advisory containing all four fixes.
Check whether sctp, sctp_diag, ah6/xfrm, tun, pppoe modules are loaded on high-value hosts.
Review dmesg/journal for OOB/UAF oops patterns around the disclosure window.

Sources

https://heyitsas.im/posts/lpe-quartet/
https://www.openwall.com/lists/oss-security/2026/09/18/3
https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html
https://nvd.nist.gov/vuln/detail/CVE-2026-80844

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].