LPE Quartet: four Linux kernel bugs with PoCs to root

LPE Quartet: four Linux kernel bugs with PoCs to root

Researcher Asim Viladi Oglu Manizada published details of four Linux kernel vulnerabilities that had existed for 10 to 21 years. For each one, he developed a PoC demonstrating local privilege escalation to root.

DirtyAH6 — CVE-2026-80844.In IPv6 IPsec AH, ipv6_rearrange_rthdr() did not check that segments_left did not exceed the number of segments, allowing memmove() to go out of bounds. The PoC corrupts skb_shared_info, replaces pam_rootok.so with pam_permit.so, and gains root through su.

TUNderflow — CVE-2026-81000. An integer underflow in SKB_MAX_HEAD() during receive-headroom calculation for TUN/TAP causes subsequent pointer arithmetic to place skb->data outside the allocated buffer. An out-of-bounds write through Open vSwitch then lets the PoC modify a file-backed pipe buffer and gain root through PAM.

PPPoEject — CVE-2026-68121. pppoe_sendmsg() stores a pointer inside the skb, even though the skb head can be reallocated and the old allocation freed during dev_hard_header(). Subsequent writes through the stale pointer allow the PoC to corrupt struct file and ultimately set root credentials.

DiagSpill — CVE-2026-74469. In SCTP, the 16-bit transport_count wraps at 65,536 peer transports. sctp_diag then reserves no space for the peer list but copies all of it, producing an approximately 8 MiB out-of-bounds write from a Netlink buffer. The PoC corrupts page tables, maps host memory through them, finds a credential object, and rewrites it to gain root.

The first three published LPEs use unprivileged user namespaces, although the affected paths are also accessible to processes with the necessary capabilities. DiagSpill does not require user namespaces or special capabilities if SCTP and sctp_diag are available.

Two of the bugs have limited remote scenarios. DirtyAH6 can cause memory corruption on an IPv6 router/gateway with AH transport mode. In a lab environment, the author achieved remote root after preliminary memory grooming, but considers fully remote memory grooming extremely difficult. With SCTP ASCONF/ADD-IP enabled, DiagSpill allows remote corruption/DoS; however, the author found no practical path to remote root.

The vulnerabilities were discovered as part of AI-assisted vulnerability hunting: the author combined graph-based tracking of security-relevant objects with agent tooling for analyzing memory state.

The first stable kernel releases containing all four fixes are: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.

Article: https://heyitsas.im/posts/lpe-quartet/

PoC (DirtyAH6): https://github.com/manizada/DirtyAH6

PoC (TUNderflow): https://github.com/manizada/TUNderflow

PoC (PPPoEject): https://github.com/manizada/PPPoEject

PoC (DiagSpill): https://github.com/manizada/DiagSpill