Executive Threat Summary: The "LPE Quartet" Weaponized Exploitation Wave

Independent security researcher Asim Viladi Oglu Manizada has published comprehensive technical disclosures and functional, working proof-of-concept (PoC) exploit chains targeting four distinct local privilege escalation (LPE) vulnerabilities in the Linux kernel. Dubbed the "LPE Quartet", the defects span core networking and encapsulation subsystems that have resided quietly in the kernel codebase for between 10 and 21 years.

The four vulnerabilities—cataloged as CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill)—allow local unprivileged processes or compromised container workloads to corrupt kernel memory, overwrite security credentials, and spawn arbitrary root shells. In certain narrow network topologies, two of the flaws also introduce remote denial-of-service or host crash capabilities.

Following a coordinated multi-week disclosure embargo managed by the security@kernel.org team and distributor security leads across Red Hat, Ubuntu, SUSE, and Debian, upstream maintainers released consolidated security patches across all active stable kernel branches. However, the release of turn-key public exploit repositories drastically increases exposure for enterprise Kubernetes nodes, shared multi-tenant cloud instances, and unpatched production servers.

Technical Root Cause & Vulnerability Breakdown

All four flaws represent classic memory-safety oversights within the kernel network stack, resulting from boundary calculation mistakes, pointer aliasing, or integer truncations:

1. DirtyAH6: IPv6 IPsec Authentication Header Boundary Failure (CVE-2026-80844)

The DirtyAH6 vulnerability resides in net/ipv6/ah6.c within the IPsec Authentication Header implementation under the kernel's XFRM framework. Before verifying authentication signatures, the kernel normalizes mutable IPv6 fields, including routing header address pointers via ipv6_rearrange_rthdr(): 

/* Vulnerable pattern in net/ipv6/ah6.c */
segments = rthdr->hdrlen >> 1;
/* Code omitted boundary validation: segments_left <= segments */
rthdr->segments_left = 0;

The function calculated total address segments from hdrlen but failed to verify that segments_left <= segments. By sending a raw IPv6 packet with IP_HDRINCL, hdrlen=2, and an oversized segments_left=255, an attacker forces an arithmetic underflow, moving the internal address pointer backwards by 4,064 bytes. When the subsequent memmove() executes, it writes 4,064 bytes out of bounds.

In the researcher's weaponized exploit, the out-of-bounds write corrupts skb_shared_info. Reusing techniques pioneered in earlier IPsec research, the exploit forces an ESP decryption cycle to overwrite a file-backed page cache buffer corresponding to /etc/pam.d/su, swapping pam_rootok.so with pam_permit.so to grant instantaneous, passwordless root authentication.

2. TUNderflow: Integer Underflow in Virtual Network Headroom (CVE-2026-81000)

Located in drivers/net/tun.c, TUNderflow affects TUN/TAP virtual network devices widely utilized by VPNs, container runtimes, and virtualization hypervisors. When network devices configure receive headroom via ndo_set_rx_headroom(), Open vSwitch can propagate this configuration down to underlying TUN/TAP ports: 

/* drivers/net/tun.c headroom allocation calculation */
tun->align = clamp_t(int, new_hr, NET_SKB_PAD, max_headroom);
/* When underflowing SKB_MAX_HEAD(), negative signed values become massive unsigned size_t */

When an interface passes 4,160 bytes of headroom into a raw TUN port, SKB_MAX_HEAD(4160) underflows. The resulting negative integer wraps to a massive positive size_t value. Subsequent allocation calculations in tun_alloc_skb() misalign skb->data by 64 bytes past the allocated 4,096-byte memory slab. The weaponized exploit lines up file-backed pipe buffers in adjacent memory slabs, triggers the out-of-bounds write to set the PIPE_BUF_FLAG_CAN_MERGE flag, and conducts arbitrary writes to arbitrary disk-backed binaries.

3. PPPoEject: Use-After-Free in PPPoE Socket Dispatch (CVE-2026-68121)

Located in drivers/net/ppp/pppoe.c, PPPoEject involves a race condition and stale pointer reuse during PPP over Ethernet frame generation. In pppoe_sendmsg(), the kernel retains a direct pointer into the socket buffer (skb) head while invoking the low-level device header handler: 

/* drivers/net/ppp/pppoe.c */
dev_hard_header(skb, dev, ETH_P_PPP_SES, po->pppoe_pa.remote, NULL, total_len);
/* Fix: Explicitly re-read header offset after expansion */
ph = pppoe_hdr(skb);
memcpy(ph, &hdr, sizeof(struct pppoe_hdr));

If a lower-level device callback calls pskb_expand_head()—such as when adding an initial GRE/IP6GRE interface to a bonding device while suspending payload copies via FUSE—the memory slab backing the skb head is freed and reallocated elsewhere. The PPPoE handler subsequently writes header data into the freed memory block. The weaponized exploit races populated file descriptor tables into the freed slab, redirecting an active descriptor to an attacker-controlled fake struct file, yielding controlled kernel instruction execution and privilege escalation to UID 0.

4. DiagSpill: Unrestricted 8 MiB Buffer Overflow in SCTP Socket Diagnostics (CVE-2026-74469)

Unlike the other three flaws, DiagSpill (net/sctp/sctp_diag.c) carries zero prerequisite requirements for unprivileged user namespaces or specialized Linux capabilities. Any local user on a system with the Stream Control Transmission Protocol (sctp) kernel module active can exploit it.

The vulnerability stems from a 16-bit integer wraparound in transport_count within SCTP peer tracking structures: 

/* net/sctp/sctp_diag.c upstream fix */
if (asoc->peer.transport_count == U16_MAX)
    return NULL;

peer = sctp_transport_new(asoc->base.net, addr, gfp);

Because the counter is limited to 16 bits (uint16_t), the addition of the 65,536th peer transport wraps the counter back to zero. When a monitoring tool or local process issues an SCTP_DIAG Netlink request via sock_diag, the kernel reserves zero bytes of payload space while copying the full list of 65,536 transports, spilling approximately 8 Megabytes of continuous data past the boundary of the Netlink socket buffer. The researcher's exploit grooms the overflow into kernel page tables, maps arbitrary physical memory, modifies the running process's credentials, and appends a passwordless privilege entry into the system sudoers structure.

Frontier AI & Autonomous Agentic Vulnerability Discovery

Beyond its immediate patch urgency, this disclosure represents a critical evolution in computer security research: the automated, AI-assisted discovery of deep kernel flaws.

Researcher Asim Manizada revealed that all four flaws were uncovered using an autonomous agentic harness combining graph-based semantic tracking with large language models trained to "reason geometrically" about kernel heap memory states and buffer alignments. Notably, the upstream Linux kernel security patch committed by networking maintainers for DirtyAH6 explicitly acknowledges this technique in the git commit metadata: 

Commit: 7bad4bda74dc4713f398d3b7624ff05478e3a568
Author: Asim Viladi Oglu Manizada
Assisted-by: Custom LLM Kernel Geometry Reasoning Agent
Signed-off-by: Stefan Klassert <stefan.klassert@secunet.com>

This official acknowledgement confirms that machine learning agents have transitioned from superficial fuzzing to identifying complex, multi-step memory layout flaws that survived decades of manual code review by the world's leading kernel developers.

Blast Radius: Multi-Tenant Clouds & Container Breakouts

The operational danger of these vulnerabilities is amplified in cloud and container environments:

  • Unprivileged User Namespaces: DirtyAH6, TUNderflow, and PPPoEject require CAP_NET_ADMIN within an attacker-controlled user namespace. Because modern distributions (Ubuntu, Debian, Arch) enable unprivileged user namespaces by default (kernel.unprivileged_userns_clone = 1), any unprivileged local user or standard shell account can create a namespace, grant itself CAP_NET_ADMIN inside that namespace, and trigger the kernel bug.
  • Container Workload Escapes: Any container running with standard networking privileges (e.g., ingress controllers, mesh sidecars, or CNI plugins holding CAP_NET_ADMIN or CAP_NET_RAW) can execute these exploits directly without requiring host root access, completely compromising the parent host kernel.
  • Zero-Prerequisite Attack Surface: Because DiagSpill bypasses user namespace restrictions entirely, hardened container runtimes that restrict namespaces remain vulnerable if the host kernel has loaded sctp.ko.

Vulnerability & Kernel Patch Matrix

Enterprise administrators should verify kernel versions against the upstream stable baseline fixes:

Vulnerability Name CVE Identifier Subsystem Prerequisites First Fixed Upstream Release
DirtyAH6 CVE-2026-80844 IPsec AH6 (IPv6) User Namespaces (or CAP_NET_ADMIN) 5.10.269, 5.15.220, 6.1.187, 6.6.156, 6.12.108, 6.18.49, 7.2.3
TUNderflow CVE-2026-81000 TUN/TAP / Open vSwitch User Namespaces (or CAP_NET_ADMIN) 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
PPPoEject CVE-2026-68121 PPP over Ethernet User Namespaces (or CAP_NET_ADMIN) 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
DiagSpill CVE-2026-74469 SCTP (sctp_diag) None (SCTP module available) 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8

Actionable Defensive Playbook & Mitigations

1. Immediate Kernel Upgrade

Deploy updated vendor kernel packages across all virtual machine images, bare-metal servers, and container host nodes. The comprehensive set of all four fixes is present in: 

# Minimum upstream patch baseline:
# Linux 5.10.270 / 5.15.221 / 6.1.188 / 6.6.157 / 6.12.109 / 6.18.50 / 7.2.4

# On Debian / Ubuntu systems:
sudo apt update && sudo apt dist-upgrade -y
sudo reboot

# On RHEL / Rocky / AlmaLinux systems:
sudo dnf upgrade -y kernel
sudo reboot

2. Restrict Unprivileged User Namespaces

For environments unable to reboot immediately, disabling unprivileged user namespaces neutralizes the primary exploitation vector for DirtyAH6, TUNderflow, and PPPoEject: 

# Disable unprivileged user namespaces dynamically:
sudo sysctl -w kernel.unprivileged_userns_clone=0

# On systems supporting max_user_namespaces:
sudo sysctl -w user.max_user_namespaces=0

# Persist across system reboots:
echo "kernel.unprivileged_userns_clone = 0" | sudo tee /etc/sysctl.d/99-disable-userns.conf
echo "user.max_user_namespaces = 0" | sudo tee -a /etc/sysctl.d/99-disable-userns.conf
sudo sysctl --system

3. Blacklist Unused Kernel Modules (Mitigating DiagSpill & PPPoEject)

To prevent unprivileged users from dynamically loading vulnerable modules on demand, blacklist the associated protocol drivers: 

# Create module blacklist configuration:
sudo tee /etc/modprobe.d/disable-lpe-quartet.conf <<EOF
install sctp /bin/true
install sctp_diag /bin/true
install pppoe /bin/true
install ah6 /bin/true
EOF

# Unload modules from memory if not currently in use:
sudo rmmod sctp_diag sctp pppoe ah6 2>/dev/null || true

4. Telemetry & Detection Queries

Monitor Linux audit logs and eBPF process telemetry for unauthorized user namespace creation and unusual PAM file tampering: 

# Audit rule: Monitor modifications to PAM authentication configs
sudo auditctl -w /etc/pam.d/ -p wa -k pam_tamper

# Audit rule: Alert on unshare() syscall with CLONE_NEWUSER
sudo auditctl -a always,exit -F arch=b64 -S unshare -F a0=0x10000000 -k userns_creation