A cybersecurity expert has published functional exploit code for four vulnerabilities in the Linux kernel that allow a local user to gain root access, the highest level of privileges on a system.
All four vulnerabilities have been patched by kernel maintainers in recent weeks, so systems running the latest kernel are not at risk. However, since the exploit code is now public, it is crucial for machines still running older kernels to be updated.
The vulnerabilities are named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. These were discovered by researcher Asim Manizada, who reported them to the Linux kernel security team in mid-July.
On September 18, Manizada released a detailed write-up along with working exploits after coordinating with Linux distributions to ensure that fixes were released first.
As of now, there have been no reported instances of these vulnerabilities being exploited in real-world attacks. The exploits created by Manizada are tailored to specific kernel builds and can potentially crash a system, so they should only be used on isolated test environments.
Affected Systems
Three out of the four vulnerabilities can be exploited by an ordinary user only when unprivileged user namespaces are enabled. User namespaces allow a regular user to act as root within a confined environment. Many Linux distributions enable this feature by default, providing attackers with the network privileges necessary to exploit the vulnerabilities.
The fourth vulnerability, DiagSpill, does not require user namespaces or special privileges, as long as the system has the SCTP networking module available.
Resolution Steps
To mitigate the risk posed by these vulnerabilities, it is essential to update to a kernel that includes all four fixes. The initial stable kernel releases containing these fixes are:
- 5.10.270
- 5.15.221
- 6.1.188
- 6.6.157
- 6.12.109
- 6.18.50
- 7.2.4
Most users run kernels provided by their distributions, such as Debian, Ubuntu, Red Hat, or SUSE, which may have their own versioning schemes. It is recommended to check the distribution’s security advisories to ensure that the updates include all four fixes.
If immediate patching is not feasible, two interim measures can help reduce the risk:
- Disable unprivileged user namespaces to prevent exploitation of three vulnerabilities.
- Turn off the affected features (AH6, TUN/TAP, PPPoE, SCTP) if they are not in use.
Manizada advises patching over feature deactivation since alternate pathways to the vulnerabilities may exist.
Vulnerability Exploitation
All four vulnerabilities stem from memory safety issues in different segments of the kernel’s networking code. Each flaw allows an attacker to manipulate kernel memory, enabling them to escalate privileges to root level. These vulnerabilities have existed for a significant time, ranging from 10 to 21 years.
Manizada utilized an AI-driven approach to identify these flaws, which led to the discovery of DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. The commit for fixing DirtyAH6 acknowledges the assistance of Manizada’s custom AI tooling.
This series of privilege escalation vulnerabilities in the Linux kernel follows a trend of security disclosures in 2026, with some flaws being identified with the aid of large language models. Manizada had previously disclosed a similar flaw in Open vSwitch, known as OVSwrap, in July.
Furthermore, one of the newfound exploits incorporates a technique from Dirty Frag, another kernel root flaw disclosed earlier in the year. While concluding his analysis, Manizada indicated that this batch of vulnerabilities likely marks the conclusion of his AI-driven bug hunting phase.
