A researcher disclosed four Linux kernel privilege-escalation vulnerabilities on 18 September 2026, with public proof-of-concept code for each. The flaws are CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469, and could allow a local user to obtain root privileges. Three have CVSSv3 scores of 7.8 or 8.8; CVE-2026-80844 is still awaiting analysis. No exploitation in the wild has been confirmed.
All four bugs affect kernel networking code and are described as memory-safety issues. CVE-2026-80844 involves insufficient validation in IPv6 IPsec Authentication Header handling; CVE-2026-81000 is a size underflow in TUN/TAP processing; CVE-2026-68121 uses a stale pointer in the PPPoE send path; and CVE-2026-74469 involves a 16-bit SCTP transport counter wrapping at 65,536, potentially causing an approximately 8 MiB buffer overflow.
The first three generally require unprivileged user namespaces, while CVE-2026-74469 does not. The article says two flaws may also be remotely triggerable in specific conditions, although remote root is described as extremely difficult.
The issues affect kernel series dating back to 2.6.12, including unsupported releases. The researcher recommends upgrading to distribution kernels containing the fixes; listed first fixed stable releases include 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. Disabling unprivileged user namespaces can reduce exposure to the first three flaws, but does not address CVE-2026-74469 or suitably privileged containers.