Four ancient Linux kernel bugs yield local root

Four Linux kernel flaws that let a local unprivileged user reach root have been disclosed after a coordinated embargo with distributors, with fixes already landing in stable releases. The bugs, nicknamed DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, had lingered in the kernel for between 10 and 21 years.

CVE-2026-80844 (DirtyAH6) is a validation failure in IPv6 Authentication Header handling under XFRM that can corrupt kernel state. CVE-2026-81000 (TUNderflow) undersizes receive headroom on the TUN driver so oversized packets overwrite adjacent memory. CVE-2026-68121 (PPPoEject) reuses a stale header pointer after a PPPoE lower-device call, again enabling corruption. CVE-2026-74469 (DiagSpill) lets an SCTP peer transport count overflow and spill data.

All four proof-of-concept exploits achieve unprivileged-to-root code execution on vulnerable configurations. The first three require either unprivileged user and network namespaces or specific capabilities (CAP_NET_ADMIN, and in one case CAP_NET_RAW) inside an attacker-controlled network namespace, plus the relevant kernel networking features. DiagSpill needs no namespace or capability prerequisites beyond SCTP support.

The underlying corruption primitives in DirtyAH6 and DiagSpill are reachable from the network under tightly constrained conditions; DirtyAH6 is described as theoretically groomable into remote root, though with difficulty and low practical likelihood.

Stable kernels containing all four fixes begin with 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Operators who expose the affected networking paths, especially on hosts that allow unprivileged namespaces, should treat the updates as priority local-privilege-escalation patches.