Public Exploits Drop for Four Linux Kernel Flaws as CISA Warns of Active Exploitation: A Complete Technical Breakdown

Seven critical kernel vulnerabilities in one week show how fragile Linux networking code is, and how AI-assisted bug hunting is changing the threat landscape

This was the Linux kernel’s most consequential security week of 2026. On September 18, security researcher Asim Manizada published working exploit code for four local privilege escalation vulnerabilities, collectively dubbed the “LPE Quartet.” Any local user can use them to take complete root control of an affected machine. The disclosure followed a two-month embargo coordinated with kernel maintainers and Linux distributions. The same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three more Linux kernel flaws to its Known Exploited Vulnerabilities catalog, confirming that attackers are already exploiting them in the wild.

The two events share a cause. Kernel vulnerabilities are being discovered, disclosed and weaponized differently than they used to be. Manizada found the four flaws, named DirtyAH6, TUNderflow, PPPoEject and DiagSpill, with an AI-assisted research harness that reasons about kernel memory layout. The underlying bugs had gone undetected for between 10 and 21 years. CISA’s additions include a CVSS 9.8 flaw in the kernel’s TLS receive path that can be triggered remotely, and federal agencies have three days to fix it under Binding Operational Directive 26-04.

Linux runs most cloud servers, containerized workloads and enterprise systems, so most organizations are affected. They need to act now, and they should rethink how often they patch.

The LPE Quartet: four memory corruption bugs in kernel networking

The four vulnerabilities sit in different subsystems of the kernel’s networking stack. All four are memory-safety bugs that let an attacker corrupt kernel memory and escalate to root. The affected code covers IPsec authentication processing, virtual network device drivers, PPP over Ethernet session handling and SCTP diagnostic reporting. That is a cross-section of the kernel’s most complex and least-audited networking code.

Manizada reported the flaws to security@kernel.org in mid-July 2026. Fixes landed over the following weeks through a coordinated embargo with the linux-distros@ mailing list. Public disclosure came on September 18 at 06:00 UTC, timed to give system owners as much time as possible to patch before the exploit code spread.

DirtyAH6 (CVE-2026-80844): IPsec IPv6 Authentication Header overflow

DirtyAH6 is the most technically ambitious of the four. It lives in the kernel’s XFRM/IPsec code that processes IPv6 Authentication Headers. The function ipv6_rearrange_rthdr() reads the number of addresses from a routing header’s hdrlen field, then uses segments - segments_left to reposition an internal address pointer. It never checks that segments_left does not exceed segments.

A crafted raw IPv6 packet with hdrlen=2 and segments_left=255 moves the pointer backward by 4,064 bytes. A 4,064-byte memmove() then runs entirely out of bounds, giving a controlled out-of-bounds write in kernel memory.

The flaw also has a remote attack surface. If a target acts as an IPv6 router or gateway and appends an IPsec Authentication Header in transport mode, the same corruption can be triggered over the network, though in practice that only produces a denial-of-service crash. Manizada got remote root in his lab only by pre-shaping memory on the target. He calls that “extremely difficult” from a purely remote position, though he does not rule it out entirely.

The fix validates segments_left before any pointer arithmetic and returns -EINVAL through the existing AH6 error paths when the check fails.

TUNderflow (CVE-2026-81000): integer underflow in virtual network devices

TUN and TAP virtual network devices underpin containerized networking, VPN tunnels and software-defined infrastructure. The bug comes from a dual-use variable: tun->align serves as both spare buffer headroom and a size parameter in tun_get_user().

Picture a netkit device with 4,096 bytes of receive headroom sitting beneath a VXLAN device and an Open vSwitch datapath. It can propagate 4,160 bytes of headroom to a raw TUN port. The macro SKB_MAX_HEAD(4160) then underflows, producing a negative good_linear value that wraps to an enormous positive size_t. Later arithmetic on prepad + linear and len - linear wraps again, leaving skb->data 64 bytes past the end of its 4,096-byte allocation.

The exploit places file-backed pipe buffers next to the corrupted TUN packet. The out-of-bounds write sets PIPE_BUF_FLAG_CAN_MERGE on a pipe buffer. A pipe write then replaces the PAM authentication module pam_rootok.so with pam_permit.so in /etc/pam.d/su, which gives an immediate root shell via su.

PPPoEject (CVE-2026-68121): use-after-free in PPP over Ethernet

PPPoE carries Point-to-Point Protocol sessions inside Ethernet frames and is still widely deployed in DSL and fiber-to-the-home infrastructure. This one is a classic use-after-free. pppoe_sendmsg() keeps a pointer into the socket buffer’s head region while it calls dev_hard_header(), a device callback that can invoke pskb_expand_head() and free the original buffer allocation.

The attacker blocks the payload copy on a FUSE filesystem while adding the first GRE or IP6GRE port to an empty team or bonding device. That triggers the reallocation just as PPPoE still holds its stale pointer, and later header and length writes corrupt freed memory.

The exploit races populated file descriptor tables into the freed skb head region. It uses the PPPoE writes to redirect a live file descriptor entry to an attacker-built fake struct file, then closes that descriptor to invoke a controlled kernel callback. The callback installs root credentials and spawns a root shell.

DiagSpill (CVE-2026-74469): 16-bit counter overflow in SCTP diagnostics

DiagSpill is the most operationally dangerous of the four. It needs no unprivileged user namespaces and no special capabilities, only that the SCTP networking module and the sctp_diag reporting code are available on the target. An SCTP association supports up to 65,536 peer transports, but the transport_count field is only 16 bits wide, so it wraps to zero when the 65,536th transport is added.

The sctp_diag code reports socket and peer information through the sock_diag Netlink interface. After the wrap, it reserves zero bytes for peer transport data but still copies the full list of sockaddr_storage structures. Roughly 8 MiB of data spills past the end of its Netlink response buffer.

The exploit shapes that overwrite into kernel page tables and uses the corrupted tables to map arbitrary host memory. It then finds and rewrites a process credential object, installs a sudoers rule and opens a root shell.

Remote exploitation is possible under narrow conditions. If ASCONF/ADD-IP is enabled alongside SCTP-AUTH (both are off by default), a malicious peer can add enough transports to trigger the overflow, and any local diagnostic tool such as ss that issues a sock_diag request completes the corruption. Manizada says he sees “no path to full remote root, even assuming perfect remote memory grooming.”

Exploitation prerequisites and the user namespace question

Three of the four flaws, DirtyAH6, TUNderflow and PPPoEject, need unprivileged user namespaces for an ordinary local user to exploit them. User namespaces give a non-root user full capabilities, including CAP_NET_ADMIN and CAP_NET_RAW, inside an isolated namespace. That is how the attacker gets the network privileges the exploits need.

Whether to enable them has become one of the most contested configuration decisions in Linux security. Research Edera published in April 2026 found that enabling user namespaces exposes 262% more kernel attack surface to an unprivileged container process. In their tests, 27 of 40 kernel operations became reachable, against only 8 without namespaces. The same research cataloged more than 40 Linux kernel CVEs from 2020 through 2025 where user namespaces were a prerequisite, and 43% of them were concentrated in the nf_tables subsystem alone.

Many major distributions enable unprivileged user namespaces by default, though Ubuntu, Debian and Docker have progressively restricted the feature. Docker’s default seccomp profile has blocked unshare(CLONE_NEWUSER) since version 20.10, and Ubuntu 24.04 introduced AppArmor-based user namespace restrictions. The feature is still enabled on countless servers, development workstations and cloud instances.

Disabling user namespaces does not fully remove the risk either, Manizada notes. A container or process that already holds CAP_NET_ADMIN and CAP_NET_RAW can trigger the same corruption paths without creating new namespaces. That makes container escape theoretically possible, although he did not build a proof of concept for it. His testing also showed that neither AppArmor nor SELinux blocked the exploits in their default configurations.

DiagSpill stays fully reachable whatever the namespace configuration, as long as SCTP support is compiled in or loadable.

Affected kernel versions and patch availability

The bugs span a very wide range of kernel releases. DirtyAH6 goes back to kernel 2.6.12, released in 2005. TUNderflow affects kernels from 4.6 onward, and PPPoEject and DiagSpill affect kernels from 2.6.12 and 4.7 respectively. Many of the older kernel series are end-of-life and will never get upstream fixes.

The first stable kernel releases with all four fixes are:

• 5.10.270 (longterm)
• 5.15.221 (longterm)
• 6.1.188 (longterm)
• 6.6.157 (longterm)
• 6.12.109 (longterm)
• 6.18.50 (longterm)
• 7.2.4 (stable)

Most organizations run distribution-maintained kernels with vendor-specific version numbers, though. Debian, Ubuntu, Red Hat Enterprise Linux and SUSE each backport fixes on their own schedules and issue their own advisory numbers. Amazon Linux has already published live-patch advisories covering all four CVEs. Check your distribution’s security tracker instead of trying to match upstream version numbers directly.

CISA’s parallel warning: three kernel flaws under active exploitation

The LPE Quartet has no confirmed in-the-wild exploitation, but the three vulnerabilities CISA added to its KEV catalog on September 18 are confirmed as actively exploited. Security teams already triaging the Manizada disclosure now have a second fire to put out.

CVE-2025-39682: critical TLS receive path flaw (CVSS 9.8)

This is the most severe of the three. It sits in the kernel’s TLS implementation, specifically how it handles zero-length records on the rx_list when kernel TLS (kTLS) is attached to TCP sockets. The CVE record describes a corner case in which a zero-length record bypasses the intended recvmsg() record-type handling, so later TLS records are processed under the wrong zero-copy and queuing assumptions.

The flaw breaks a basic receive-path rule: one recvmsg() call should process either contiguous data records or a single non-data record. When the first queued record has zero length, the type-transition check is skipped entirely and the socket buffer ends up in an unsafe state.

Red Hat confirms the affected code path can be triggered remotely when kTLS is in use. Internet-facing services that use kernel TLS are therefore a critical remediation priority. The CVSS 9.8 rating reflects a network attack vector, low complexity, no privileges required and no user interaction.

CVE-2026-53266: netfilter bridge ebtables out-of-bounds write (CVSS 8.8)

This high-severity bug affects the netfilter bridge ebtables SNAT target. During an optional rewrite of the ARP sender hardware address, the kernel may call skb_store_bits() without making sure the destination range is writable. If the target data sits in a nonlinear socket-buffer fragment backed by a splice-imported file page, the write goes straight into the underlying page and corrupts file-backed memory.

A local attacker who can configure specific bridge netfilter rules can trigger memory corruption, denial of service or possibly privilege escalation. The upstream fix checks that the ARP sender hardware-address range is writable before the kernel modifies it.

CVE-2025-39964: AF_ALG cryptographic interface race condition (CVSS 7.8)

A race condition in the kernel’s AF_ALG cryptographic socket interface lets concurrent writes to the same socket interleave unpredictably and leave internal state inconsistent. The fix adds exclusive write ownership, so only one writer can call sendmsg() at a time.

All three KEV additions carry a remediation deadline of September 21, 2026, under BOD 26-04, CISA’s directive that cuts federal patching timelines to as little as three calendar days for the highest-risk vulnerabilities. CISA also requires forensic triage. Agencies must check potentially exposed assets for signs of compromise, because installing the patch is not treated as a sufficient response.

The AI-assisted discovery shift

The bigger story this week is methodological. Manizada found all four flaws with a custom AI-assisted harness that combines graph-based tracking of security-relevant kernel objects with tooling that lets agents reason “geometrically” about kernel memory state. The kernel’s fix commit for DirtyAH6 includes an “Assisted-by” line crediting this tooling, a first for mainline kernel patches.

It was not a one-off experiment. In April 2026, Manizada published details of a self-orchestrating team of vulnerability-hunting agents that found more than 20 CVEs across major software projects, including the Linux kernel’s ksmbd server, Docker, OpenSSL, CUPS, HAProxy, dnsmasq and Samba. The harness has hypothesis generators, hunters running in isolated virtual machines, report writers, external graders to prevent reward-hacking, and a conductor that steers agents away from unproductive paths.

The trend is speeding up. In his Linux 7.1-rc4 release post in May 2026, Linus Torvalds said the kernel’s private security mailing list had become “almost entirely unmanageable” because of AI-generated bug reports. They had grown from 2 or 3 a week two years ago to 5 to 10 a day in 2026. Kernel maintainer Willy Tarreau reported that the team had to recruit more maintainers just to keep up with the volume.

An Anthropic researcher demonstrated Claude finding a previously unknown critical vulnerability in a 50,000-star GitHub project in about 90 minutes, and also identifying remotely exploitable heap buffer overflows in the Linux kernel. OpenAI’s o3 model found CVE-2025-37899, a use-after-free in the kernel’s networking code.

For defenders, Edera’s research puts it bluntly: “The 40 CVEs in our dataset were found over five years by dozens of specialists. The next 40 CVEs will not take five years.”

Manizada himself hinted that this phase is ending. His write-up closes with the line: “Given some personal/professional developments, this likely concludes the AI-assisted vulnerability hunting experiment — at least in its public form — for some while.”

Immediate action items for system administrators

Patch immediately. Update to a kernel that carries all four LPE Quartet fixes. For upstream kernels, the minimum versions are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 or 7.2.4. For distribution kernels, check your vendor’s security advisory and confirm the update covers all four CVEs.

If you operate U.S. federal systems, BOD 26-04 requires remediation of CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964 by September 21, 2026, along with forensic triage of potentially compromised assets.

If patching is delayed, disable unprivileged user namespaces. This blocks the ordinary-user exploitation path for DirtyAH6, TUNderflow and PPPoEject, but it does not protect against privileged containers or DiagSpill:

sysctl -w kernel.unprivileged_userns_clone=0

If your systems don’t need AH6, TUN/TAP, PPPoE or SCTP, stop those modules from loading. That removes the underlying bug surface, but it does not replace patching, since other exploitation paths may exist.

For the actively exploited CVE-2025-39682, disable kTLS if you don’t use it. That closes the remote attack vector.

Audit for compromise as well as patching. KEV inclusion means CISA expects a forensic investigation. Look on exposed systems for kernel crashes, suspicious privilege changes, unexpected namespace activity, unauthorized netfilter modifications and unusual sock_diag requests.

Finally, reboot and verify the running kernel. Installing updated packages does nothing until you boot into the corrected kernel. Run uname -r and confirm the version matches the patched package.

The structural problem: decades-old code meets machine-scale discovery

The four LPE Quartet bugs lasted 10 to 21 years. DirtyAH6’s flawed pointer arithmetic dates to the initial IPv6 AH implementation, and PPPoEject’s use-after-free has been there since the PPPoE driver was merged. These are basic memory-safety violations in code that handles untrusted input on nearly every Linux system, and they are not subtle logic errors.

They lasted because of a resource gap that AI is now closing. Kernel networking code is very complex, a small pool of maintainers reviews it, and it rarely gets the sustained adversarial attention userspace software gets. The code works for the common case. The bugs live in corner cases that take deep structural understanding to spot.

That understanding is no longer scarce. The harness that found four kernel root exploits in one research cycle also found remote unauthenticated out-of-bounds writes in ksmbd, a container-to-host breakout in Docker and a remote code execution chain in CUPS. It did all of it autonomously, with working proof-of-concept code.

The kernel community is adapting. Linux 7.1 shipped new security-bug documentation that changes the private reporting channel. AI-assisted findings now go to public channels by default, and reporters must submit tested patches with their findings. The private list is reserved for urgent flaws that give an attacker capabilities they should not have on a correctly configured production system.

Process changes can’t undo 21 years of accumulated memory-unsafe code, though. The Rust-for-Linux effort is entering its fourth year of mainline integration, but it addresses new code, and the existing 30-plus million lines of C remain.

What this week means for Linux security

Four public root exploits, three confirmed in-the-wild kernel exploitations and the maturing of AI-driven vulnerability research all arrived at once. Organizations that still treat kernel patching as a quarterly maintenance task are now up against adversaries, human and automated, who find, weaponize and deploy kernel exploits within days.

Memory safety in kernel networking code cannot be assumed, and user namespaces greatly expand the exploitable surface. The gap between a vulnerability existing and a public exploit appearing has shrunk to almost nothing. Finding kernel bugs has become cheap, while fixing them still takes people.

For the estimated 96% of internet-facing servers running Linux, this week is what the new baseline looks like.