FHN 
Four recently disclosed vulnerabilities in the Linux kernel could allow local attackers to corrupt kernel memory and potentially gain root-level privileges on vulnerable systems.
The flaws affect several networking components that have been part of the Linux kernel for years. They are known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill and are tracked as:
- CVE-2026-80844 — DirtyAH6
- CVE-2026-81000 — TUNderflow
- CVE-2026-68121 — PPPoEject
- CVE-2026-74469 — DiagSpill
Upstream fixes are now available for the affected kernel code.
DirtyAH6: IPv6 Memory Handling Bug
DirtyAH6 affects Linux IPsec/XFRM code responsible for processing IPv6 Authentication Headers.
The problem occurs when specially crafted IPv6 routing-header values are processed without properly checking the segments_left field. This can cause the kernel to use an invalid memory location and perform an out-of-bounds operation.
The main concern is local privilege escalation, particularly on systems where an attacker can create or control network namespaces.
In certain configurations, IPv6 routers or gateways using Authentication Header transport mode could also face a denial-of-service condition.
Researchers demonstrated root access in a controlled laboratory environment, although carrying out the same technique remotely was described as difficult.
TUNderflow Targets Virtual Networking
TUNderflow affects the Linux TUN/TAP virtual networking subsystem.
A local attacker can potentially provide unusually large receive-headroom values through certain network-device configurations, including paths involving Open vSwitch.
This can trigger an integer underflow while the kernel allocates a socket buffer. As a result, packet data may be placed outside the expected memory area, creating opportunities for out-of-bounds reads and writes.
PPPoEject Creates a Use-After-Free
PPPoEject affects Linux’s PPP-over-Ethernet implementation.
The vulnerability occurs because pppoe_sendmsg() can retain a pointer to a PPPoE header while another function modifies the underlying socket buffer.
If that buffer is reallocated, the original pointer becomes invalid. Subsequent operations using the stale pointer can then modify memory that has already been freed.
The upstream fix addresses the issue by retrieving the header pointer again after the device-header operation completes.
DiagSpill Can Corrupt Kernel Memory
DiagSpill affects SCTP diagnostic processing through sock_diag.
The vulnerability is related to a mismatch between the maximum number of SCTP peer transports and the size of the counter used to track them.
When the counter reaches its limit, it can wrap around to zero. The kernel may then allocate too little space before copying peer information, potentially causing data to be written beyond the allocated Netlink response buffer.
Unlike the other three vulnerabilities, DiagSpill does not require unprivileged user namespaces or special capabilities when SCTP and sctp_diag are enabled.
Remote crash scenarios may also be possible when certain SCTP address-configuration features are active, although those features are disabled by default.
Linux Kernel Updates Available
The vulnerabilities were reported to the Linux kernel security team in July, and fixes have now been released through the coordinated disclosure process.
The stable kernel releases containing fixes for all four vulnerabilities include:
- Linux 5.10.270
- Linux 5.15.221
- Linux 6.1.188
- Linux 6.6.157
- Linux 6.12.109
- Linux 6.18.50
- Linux 7.2.4
Administrators should update affected systems to a kernel version containing the fixes.
If an immediate update is not possible, organizations can reduce exposure by restricting unprivileged user namespaces and disabling networking features that are not required, such as AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag.
These workarounds provide only partial protection. In particular, disabling user namespaces does not prevent DiagSpill, so applying the appropriate kernel security updates remains the primary mitigation.
About the Author
