Four Linux Kernel Flaws Expose Systems to Root Takeover Attacks

A researcher disclosed four Linux kernel privilege-escalation vulnerabilities on 18 September 2026, with public proof-of-concept exploits available for each. CVE-2026-80844, CVE-2026-81000 and CVE-2026-68121 are rated 7.8 where scored, while CVE-2026-74469 has a CVSSv3 score of 8.8; CVE-2026-80844 is still awaiting analysis. The flaws affect networking code and can allow a local user to obtain root privileges. The bugs are present across kernel series from 2.6.12 onwards, although many older series are end-of-life. The first three generally require unprivileged user namespaces, while CVE-2026-74469 does not.

The vulnerabilities involve an out-of-bounds move in IPv6 IPsec Authentication Header processing, a size underflow in TUN/TAP receive-headroom handling, a stale pointer in the PPPoE send path and an SCTP counter overflow that can cause an approximately 8 MiB spill. Under specific conditions, DirtyAH6 and DiagSpill can also be triggered remotely; the researcher described a remote-root scenario for one as extremely difficult. There is no confirmed exploitation in the wild, but proof-of-concept code has been released and is tuned to particular distributions and kernels.

Administrators should apply distribution updates containing the fixes. The first listed stable releases covering all four issues are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. Where immediate patching is impossible, disabling unprivileged user namespaces can block the usual local route to the first three flaws, but does not address suitably privileged containers or DiagSpill. Unused AH6, TUN, PPPoE and SCTP subsystems can also be disabled.