# "LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill)

> Researcher Asim Viladi Oglu Manizada disclosed and released working proof-of-concept exploits for four Linux kernel memory-safety bugs in the networking stack (IPsec AH6, TUN/TAP, PPPoE, SCTP diag) that grant local users root. Three require unprivileged user namespaces; DiagSpill needs only the stock SCTP module. No in-the-wild exploitation has been reported; fixes shipped in stable kernels 5.10.270 through 7.2.4.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2572
- **ID:** TL-2026-2572
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469

## Description

On 2026-09-18, security researcher Asim Viladi Oglu Manizada published a technical write-up ("lpe-quartet") and four working Python/C proof-of-concept exploits for a set of Linux kernel local privilege-escalation (LPE) vulnerabilities he found using an AI-assisted vulnerability-hunting pipeline (graph-based object tracking tool 'CIFSwitch', geometric memory-state reasoning tool 'OVSwrap', and an LLM-driven fuzzing harness). All four bugs are memory-safety defects in separate networking subsystems, ranging from 10 to 21 years old in the codebase, and were reported to security@kernel.org in mid-July 2026 under coordinated disclosure with linux-distros@.

DirtyAH6 (CVE-2026-80844) is in net/ipv6/ah6.c: ipv6_rearrange_rthdr() fails to validate that a routing header's segments_left field is <= the number of addresses present. A crafted raw IPv6 HDRINCL packet with hdrlen=2 and segments_left=255 moves a pointer back 4,064 bytes and passes that length to memmove(), corrupting skb_shared_info. The PoC chains this into selective decryption of ESP-protected, file-backed memory pages to overwrite /etc/pam.d/su and hijack authentication, achieving root via su. The researcher notes limited remote exploitability against IPv6 routers running AH in transport mode with heavy memory grooming, though this is described as highly difficult.

TUNderflow (CVE-2026-81000) is in the TUN/TAP driver: tun_set_headroom()/tun_get_user() store an oversized receive-headroom value (propagated through stacked devices such as netkit/VXLAN/Open vSwitch to a raw TUN port) directly into tun->align, causing SKB_MAX_HEAD(4160) arithmetic to underflow. The negative good_linear value becomes a huge positive size_t, wrapping prepad+linear and len-linear so tun_alloc_skb() leaves skb->data 64 bytes past its 4,096-byte allocation. The PoC grooms file-backed pipe buffers adjacent to the corrupted packet, sets PIPE_BUF_FLAG_CAN_MERGE on a target buffer, and uses subsequent pipe writes to again overwrite /etc/pam.d/su.

PPPoEject (CVE-2026-68121) is a use-after-free in pppoe_sendmsg(), which retains a pointer into an skb head across a call to dev_hard_header(); a lower-device header callback (e.g. on a bonding/team device gaining a GRE/IP6GRE port) can call pskb_expand_head() and free that head while PPPoE still writes through the stale pointer. The PoC races a populated file-descriptor table into the freed skb head and uses the PPPoE write to redirect a live fd entry to an attacker-built fake struct file; closing that fd triggers a controlled kernel callback that installs root credentials.

DiagSpill (CVE-2026-74469) is in the SCTP stack: an association can have up to 65,536 peer transports, but transport_count (incremented in sctp_assoc_add_peer()) is only 16 bits wide, so the 65,536th transport wraps the counter to zero. sctp_diag then reserves zero peer-payload space in the Netlink response but copies the full peer-transport list, spilling roughly 8 MiB past the buffer. Uniquely among the four, DiagSpill needs no unprivileged user namespace or capability -- only the stock SCTP and sctp_diag modules. The public PoC (diagspill_root_repro.py) opens 81,920 SCTP peer transports, uses the resulting overwrite to corrupt page-middle-directory (PMD) entries into user-accessible RAM mappings, scans the exposed memory for a worker process's credential structure, zeroes its UID/GID fields, and installs a sudoers rule for root access. The PoC has narrow environmental requirements (x86-64, 4 KiB pages, exactly 4 online CPUs, 3.7-4.2 GB RAM, transparent-hugepage support) and is explicitly destructive, requiring a reboot after use. DiagSpill also has a theoretical remote-crash path if SCTP ASCONF/ADD-IP is enabled with SCTP-AUTH or addip_noauth_enable=1, though full remote root is considered unlikely.

Oracle released the first vendor patch (Oracle Linux 7/8 UEK, ELSA-2026-500330) on 2026-09-17, one day ahead of the public write-up. Upstream stable kernels 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4 carry fixes for all four issues; per-CVE NVD stable-fix commits land slightly earlier on some branches (DirtyAH6 first fixed at 5.10.269/5.15.220/6.1.187/6.6.156/6.12.108/6.18.49/7.1.13/7.2.3; PPPoEject and DiagSpill at 5.10.265/5.15.216/6.1.183, DiagSpill diverging at 6.6.151/6.12.103/6.18.44/7.1.8/7.2 and PPPoEject at 6.6.148/6.12.101/6.18.42/7.1.6/7.2). The researcher tested PoCs against Ubuntu 24.04 (6.8.0-134-generic, 6.17.0-35-generic, 6.17.0-40-generic) and Fedora 43/44 (7.1.3-100.fc43.x86_64, 6.19.10-300.fc44.x86_64), and states that AppArmor (except where it independently blocks unprivileged user-namespace creation on some Ubuntu configurations) and SELinux did not block any of the four exploits in his testing. No CVSS score was assigned at the CVE-2026-80844 NVD record as of publication; the other three carry NVD-published CVSS v3.1 base scores of 7.8 (TUNderflow, PPPoEject; vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and 8.8 (DiagSpill; vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). None of the four CVEs appear in the CISA Known Exploited Vulnerabilities catalog (checked against the 1,716-entry catalog as of 2026-09-18), and no organization has reported in-the-wild exploitation.

PPPoEject's PoC additionally opens with an x86-64 RDTSCP/prefetch timing side-channel used to defeat KASLR and locate the kernel base before memory grooming begins via an AF_PACKET TX-ring populated with fake file structures; it requires KPTI/PTI disabled, RDTSCP support, /dev/fuse access and 8,192+ file-descriptor headroom, and the Ubuntu variant may need 300+ attempts to succeed. DiagSpill's PoC spawns 2,048 credential-worker processes plus a sacrificial diagspill_hold holder process that pins the corrupted page-table state -- killing that process directly will almost certainly destabilize the kernel -- and its 8 MiB overwrite occurs because sock_diag believes only 16,384 peer transports exist while 81,920 were actually opened.

Manizada documented the discovery pipeline behind this quartet in an earlier post, "Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)" (published 2026-04-29), describing a multi-agent architecture -- hypothesis-generator agents, isolated-VM hunter agents that iterate proof-of-concepts, report writers, external graders that check severity and novelty to prevent reward-hacking, and a conductor tracking systemic blockers -- built on a tuned Qwen 3.5 27B derivative with activation steering, benchmarked against GPT-5.3-Codex and Claude models using QEMU sandboxes, CodeQL and fuzzers. CIFSwitch and OVSwrap are credited in the DirtyAH6 fix commit's Assisted-by line. The same pipeline previously produced 20+ CVEs, including CVE-2026-31432 and CVE-2026-31433 (unauthenticated remote out-of-bounds writes in Linux ksmbd), CVE-2026-41567 (a Docker container-to-host-root breakout) and CVE-2026-34980 (an unauthenticated CUPS remote-code-execution flaw), giving Manizada's AI-assisted methodology an established track record ahead of this disclosure.

## MITRE ATT&CK

- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1611 Escape to Host
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1556.003 Modify Authentication Process: Pluggable Authentication Modules
- T1082 System Information Discovery
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root](https://thehackernews.com/2026/09/public-exploits-released-for-four-linux.html)
- [Linux Kernel Hit by Four Privilege Escalation Flaws Enabling Root Access](https://cybersecuritynews.com/linux-kernel-privilege-escalation-flaws/)
- [Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell](https://gbhackers.com/linux-kernel-hit-by-4-lpe-flaws/)
- [4 Linux Kernel LPE Flaws Disclosed With Public PoC Exploits](https://securityonline.info/linux-kernel-lpe-quartet-disclosed/)
- [Four Linux Kernel Flaws Enable Local Root Privilege Escalation](https://mallory.ai/stories/01a0b394-052a-7eeb-9112-1df14660cfbf)
- [lpe-quartet: DirtyAH6, TUNderflow, PPPoEject, DiagSpill technical write-up](https://heyitsas.im/posts/lpe-quartet/)
- [DirtyAH6 proof-of-concept (GitHub)](https://github.com/manizada/DirtyAH6)
- [TUNderflow proof-of-concept (GitHub)](https://github.com/manizada/TUNderflow)
- [PPPoEject proof-of-concept (GitHub)](https://github.com/manizada/PPPoEject)
- [DiagSpill proof-of-concept (GitHub)](https://github.com/manizada/DiagSpill)
- [NVD - CVE-2026-80844](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-80844)
- [NVD - CVE-2026-81000](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-81000)
- [NVD - CVE-2026-68121](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-68121)
- [NVD - CVE-2026-74469](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-74469)
- [Red Hat Customer Portal - CVE-2026-74469](https://access.redhat.com/security/cve/cve-2026-74469)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2572