Several recently identified dangerous vulnerabilities have been disclosed, allowing individuals to gain root access to the system or achieve remote code execution.
Information has been revealed regarding four vulnerabilities in the Linux kernel that enable an unprivileged local user to execute code with root privileges. These vulnerabilities have been addressed in Linux kernel updates 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Exploits have been developed for all vulnerabilities, with demonstrations conducted in Fedora 43/44 and Ubuntu 24.04. Exploitation of the first three vulnerabilities necessitates the ability to create user namespaces or possess CAP_NET_ADMIN rights, as well as enabling support for subsystems containing vulnerabilities such as AH6/XFRM, TUN, PPPoE, and SCTP.
- DirtyAH6 (CVE-2026-80844, exploit) – This vulnerability involves a buffer overflow in the IPsec AH (Authentication Header) handler, resulting from a lack of specified value header checking. In specific conditions, the vulnerability may also be remotely exploitable.
- TUNderflow (CVE-2026-81000, exploit) – This vulnerability involves writing outside the allocated buffer when parsing an incorrectly formatted TUN packet.
- PPPoEject (CVE-2026-68121, exploit) – This vulnerability arises from accessing already freed memory in the driver PPPoE.
- DiagSpill (CVE-2026-74469, exploit) – This vulnerability involves a buffer overflow in SCT