NEWS

• Linux kernel hit by 4 Low Privilege Escalation Flaws:
  • DirtyAH6 (CVE-2026-8044):
    • A vulnerability exists in Linux’s XFRM/IPsec implementation when handling IPv6 Authentication Headers (AH).
    • The flaw involves incorrect validation of the routing header field, leading to an out-of-bounds memory access.
    • The vulnerability can result in a denial-of-service condition on IPv6 routers or gateways using AH in transport mode.
    • A local exploit requires unprivileged user namespaces.
    • Remote code execution has been demonstrated in lab environments with memory manipulation.
    • Remote exploitation is considered highly difficult.
  • TUNderflow (CVE-2026-81000)
    • This is an integer-underflow vulnerability in the Linux TUN/TAP virtual networking subsystem.
    • A specially crafted network device path can cause excessive receive headroom values to be propagated to a raw TUN device.
    • Due to integer underflow, calculations for socket buffer allocation wrap around, leading to incorrect buffer size values.
    • This results in packet handling operations that read or write outside the allocated kernel memory.
    • The vulnerability can lead to out-of-bounds memory access, potentially causing a crash or data corruption.
  • PPPoEject (CVE-2026-68121)
    • This is a use-after-free vulnerability in the PPP over Ethernet (PPPoE) subsystem.
    • The vulnerability occurs in the pppoe_sendmsg() function, which retains a pointer to a socket buffer after the lower-level device callback reallocates and frees that buffer.
    • The retained pointer becomes stale, pointing to memory that has already been freed.
    • Subsequent writes through this stale pointer can lead to a use-after-free condition.
    • This condition can be exploited by a local attacker to achieve root privilege escalation.
  • DiagSpill (CVE-2026-74469)
    • This is a vulnerability in SCTP diagnostic reporting via the sock_diag interface.
    • An SCTP association can have up to 65,536 peer transports, but the counter used to track this is only 16 bits wide.
    • When the counter value reaches its maximum and wraps around to zero, it fails to accurately reflect the true number of peer transports.
    • The kernel allocates insufficient Netlink response buffer space before copying peer transport data.
    • This results in an overwrite of approximately 8 MB of kernel memory.
    • The flaw can lead to a buffer overflow and potential kernel crash or data corruption.