Four Linux Kernel Bugs Hid for a Decade or More; Fixes Are Out While Active Exploits Surface Elsewhere
Security researcher Asim Manizada publicly disclosed four local root exploits, dubbed DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affecting Linux kernel networking code for 10 to 21 years. Fixes have landed in stable branches, while on the same day, CISA cited active exploitation of three different Linux kernel CVEs.
While much of the security world focused on a CISA bulletin on September 18, a deeper story was unfolding: a coordinated public disclosure of four local privilege escalation vulnerabilities lurking in the Linux kernel’s networking stack for between a decade and two decades.
Security researcher Asim Manizada published the details and proof-of-concept exploit code for the quartet — dubbed DirtyAH6, TUNderflow, PPPoEject, and DiagSpill[https://heyitsas.im/posts/lpe-quartet/]. Each flaw allows an unprivileged local user to escalate to root, a fundamental system compromise. Tracked as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469, respectively, the bugs were reported to kernel security teams in mid-July and published following a coordinated embargo.
The age of the vulnerabilities is as striking as their number. These memory-safety bugs persisted in the kernel code for 10 to 21 years before being discovered, and Manizada attributed their find to AI-assisted memory analysis. Independent reporting confirmed that three of the four flaws require the configuration of unprivileged user namespaces to be exploitable. DiagSpill is distinct: it requires no special privileges if the SCTP module is loaded and carries a CVSS score of 8.8.
Testing by SecurityOnline.info also indicated that security modules like AppArmor and SELinux did not block the exploits, underscoring the reach of the underlying kernel vulnerabilities. Appropriate fixes have already been merged into stable kernel branches, and the first stable releases containing patches for all four are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.
The Hacker News noted that no in-the-wild exploitation of these four bugs has been confirmed yet. However, the same publication confirmed a separate, ominous detail from the day: CISA added three other Linux kernel CVEs to its Known Exploited Vulnerabilities catalog on September 18, citing confirmed active exploitation.
The juxtaposition is the story. On one side, a researcher using modern tools to uncover and responsibly disclose a set of ancient, privilege-escalating bugs now being rapidly patched. On the other, a federal agency flagging a different set of kernel flaws that are already being leveraged by attackers in the wild, giving federal agencies until September 21st to patch. The kernel’s attack surface is broad, and the window between disclosure and exploitation is, as always, the central tension.
Sources
- A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill — heyitsas.im (Asim Manizada’s blog)
- Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root — The Hacker News
- 4 Linux Kernel LPE Flaws Disclosed With Public PoC Exploits — SecurityOnline.info (Daily CyberSecurity)