Ethical Hacking News
Four Linux kernel flaws have been disclosed, exposing local root vulnerabilities. Asim Manizada used an AI-assisted process to identify the four flaws, which were then confirmed by the Linux kernel security team. Linux users are advised to update their kernels immediately to prevent exploitation of these vulnerabilities.
Four Linux kernel flaws (DirtyAH6, TUNderflow, PPPoEject, and DiagSpill) allow a local user to gain root-level access on a machine. The flaws are categorized as memory-safety bugs in the kernel's networking code. DirtyAH6 is the most serious flaw, which can be triggered over the network to gain remote root access. TUNderflow and PPPoEject allow an ordinary user to gain root access when unprivileged user namespaces are enabled. DiagSpill requires no user namespaces or special privileges, but only SCTP networking module is required. The Linux kernel maintainers have already fixed all four flaws. Systems running an up-to-date kernel are not affected, but older kernels should be updated. Manizada recommends patching rather than turning off features to mitigate the risk.
A recent security disclosure has shed light on four Linux kernel flaws that allow a local user to gain root-level access on a machine. The vulnerabilities, dubbed DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, were discovered by security researcher Asim Manizada and published on September 18, 2026. Asim Manizada, a renowned security researcher, used an AI-assisted process to identify the four flaws, which were then confirmed by the Linux kernel security team.
The four flaws are categorized as memory-safety bugs in different parts of the kernel's networking code. Each one allows an attacker to corrupt kernel memory, which Manizada then used to gain a root shell. The underlying mistakes are old, ranging from 10 to 21 years. The most serious of the four flaws is DirtyAH6, which can be triggered over the network, but only in narrow cases and mainly to cause the system to crash. However, with the right conditions, DirtyAH6 can be used to gain remote root access.
In contrast, TUNderflow and PPPoEject are less serious, as they only allow an ordinary user to gain root access when unprivileged user namespaces are enabled. User namespaces are a Linux feature that lets a normal user act as root inside a private sandbox. Many distributions enable them by default, which is how an attacker gains the network privileges the exploits require. On the other hand, DiagSpill is the exception, as it requires no user namespaces or special privileges, as long as the system has the SCTP networking module available.
Manizada also found that two of the flaws, DirtyAH6 and DiagSpill, can be triggered over the network, but only in narrow cases and mainly to cause the system to crash. DirtyAH6 can crash a host that acts as an IPv6 router or gateway and adds an IPsec Authentication Header in transport mode. DiagSpill can crash a host only when certain SCTP options, which are off by default, are switched on. However, with the right conditions, DirtyAH6 can be used to gain remote root access.
The Linux kernel maintainers have already fixed all four flaws over the past few weeks, and any system running an up-to-date kernel is not affected. However, the exploit code is now public, and any machine still running an older kernel should be updated. To mitigate the risk, Manizada recommends patching rather than turning off features, as other paths to the same flaws may exist.
Manizada also used an AI-assisted process to identify the four flaws, which were then confirmed by the Linux kernel security team. The AI-assisted process builds a map of how the kernel handles memory and reasons about its layout. The kernel's fix for DirtyAH6 records this: the commit includes an "Assisted-by" line that credits his custom AI tooling.
Asim Manizada also disclosed a similar Open vSwitch flaw, OVSwrap, in July. One of the new exploits also reuses a technique from Dirty Frag, another Linux kernel root flaw disclosed in May by a different researcher. Manizada disclosed the similar Open vSwitch flaw, OVSwrap, in July. One of the new exploits also reuses a technique from Dirty Frag, another Linux kernel root flaw disclosed in May by a different researcher. This batch likely ends the public phase of his AI-assisted bug hunting.
The security disclosure has sent a clear message to Linux users and administrators about the importance of keeping their kernels up-to-date. The Linux kernel maintainers have already fixed all four flaws, and any system running an up-to-date kernel is not affected. However, the exploit code is now public, and any machine still running an older kernel should be updated. To mitigate the risk, Manizada recommends patching rather than turning off features, as other paths to the same flaws may exist.
Related Information:
https://www.ethicalhackingnews.com/articles/Four-Linux-Kernel-Flaws-Expose-Local-Root-Vulnerabilities-Linux-Users-Advised-to-Update-Kernels-ehn.shtml
https://thehackernews.com/2026/09/public-exploits-released-for-four-linux.html
https://securityonline.info/linux-kernel-lpe-quartet-disclosed/
Published: Fri Sep 18 16:02:18 2026 by llama3.2 3B Q4_K_M
