Linux LPE Quartet: DirtyAH6, TUNderflow, PPPoEject, DiagSpill — Patch Beyond Monday’s KEV

Monday’s kernel KEV reboot was not the whole Linux story. On September 18, researcher Asim Manizada published four more local-root memory bugs with different CVEs. The fix is the same: update the kernel again.

What happened

Alongside (and distinct from) CISA’s September 18 KEV trio, a coordinated disclosure dropped four Linux local privilege escalation bugs with working PoCs:

• DirtyAH6 (CVE-2026-80844) — IPv6 AH6/XFRM routing-header segments_left not validated before memmove; OOB access. In lab conditions, remotely groomable toward root when the target is an IPv6 AH gateway.
• TUNderflow (CVE-2026-81000) — TUN/TAP headroom underflow via oversized ndo_set_rx_headroom propagation (e.g., Open vSwitch paths).
• PPPoEject (CVE-2026-68121) — Use-after-free / stale pointer when pppoe_sendmsg keeps a pointer across dev_hard_header reallocation.
• DiagSpill (CVE-2026-74469) — SCTP transport_count 16-bit wrap lets sctp_diag spill ~8 MiB past a Netlink response. No unprivileged user-namespace requirement.

The first three LPE PoCs need unprivileged user namespaces (or equivalent CAPs in a container). DiagSpill does not. Upstream stable fixes landed across 5.10 through 7.2 trains; first releases carrying all four include 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4.

Why it matters

You may have already rebooted for Monday’s KEV trio and still be vulnerable to this quartet. Local root turns a low-privilege foothold into full control of the host. DiagSpill in particular is reachable without the usual “just disable user namespaces” shortcut. Container hosts and multi-tenant Linux remain the high-value targets.

What to do first

• Confirm whether yesterday’s kernel update also covers these four CVEs; if not, take another vendor kernel package and reboot (or verified live-patch).
• Prefer builds at or newer than the “all four fixed” train for your series.
• Where patching lags: disable unprivileged user namespaces (mitigates ordinary-user path for the first three — not DiagSpill); consider disabling unused AH6/XFRM, TUN, PPPoE, or SCTP/sctp_diag.
• Prioritize multi-tenant, CI runner, and container hosts.

Details

• Disclosure: 2026-09-18 (embargo lift)
• KEV: Not listed (separate from CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964)

Hunt / verify

• uname -r / package version against vendor advisory containing all four fixes.
• Check whether sctp, sctp_diag, ah6/xfrm, tun, pppoe modules are loaded on high-value hosts.
• Review dmesg/journal for OOB/UAF oops patterns around the disclosure window.

Sources

• https://heyitsas.im/posts/lpe-quartet/
• https://www.openwall.com/lists/oss-security/2026/09/18/3
• https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-80844

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].