Affected Systems

Linux kernel versions prior to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Four vulnerabilities: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), CVE-2026-74469 (DiagSpill). Three require unprivileged user namespaces enabled; DiagSpill requires only SCTP module availability. All distributions using upstream kernel code are affected until patched.

Exploitation Status

Public exploit code released by researcher Asim Manizada on September 18, 2026. Working PoCs available for all four flaws, tuned to specific kernel builds. No reports of active exploitation in the wild. Exploits require local access and can cause system crashes. Remote exploitation theoretically possible for DirtyAH6 and DiagSpill but only in narrow scenarios (IPv6 routers with IPsec AH transport mode, or SCTP with non-default options), primarily resulting in denial of service.

Business Impact

High risk for multi-user Linux servers, shared hosting environments, and systems where attackers may have low-privileged shell access. Local users can escalate to root on unpatched systems. Three of four flaws require unprivileged user namespaces (enabled by default on many distributions). DiagSpill exploitable by any local user if SCTP module is available. Container escape theoretically possible but no working exploit published. Remote exploitation risk is low and limited to crash scenarios. Bugs are 10-21 years old, indicating long exposure window.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Update Linux kernel to patched versions: 5.10.270+, 5.15.221+, 6.1.188+, 6.6.157+, 6.12.109+, 6.18.50+, or 7.2.4+. Verify distribution-specific security advisories for equivalent patched kernel packages.
  • If immediate patching is not possible, disable unprivileged user namespaces via sysctl: 'sysctl -w kernel.unprivileged_userns_clone=0' (blocks DirtyAH6, TUNderflow, PPPoEject but not DiagSpill).
  • Blacklist unused network modules to reduce attack surface: SCTP (sctp_diag), IPsec AH6, TUN/TAP, and PPPoE if not required. Use 'modprobe -r' or add to /etc/modprobe.d/blacklist.conf.
  • Prioritize patching for multi-user servers, shared hosting platforms, and systems with untrusted local users. Single-user workstations have lower risk.
  • Monitor for unusual privilege escalation attempts in audit logs (auditd) and review systems for unexpected root processes spawned from low-privileged accounts.