Four Linux Network Flaws Can Turn a Local User Into Root, and One Evades the Easy Mitigation
Red Hat has disclosed four Important Linux kernel flaws that target different parts of the network stack and can turn a local user into root. Three share a useful mitigation. The fourth, DiagSpill, does not need unprivileged user namespaces and may also expose some systems to remote denial of service.
| Flaw | Subsystem and prerequisite | Red Hat assessment |
|---|---|---|
| DirtyAH6, CVE-2026-80844 | IPv6 AH6/XFRM; unprivileged user namespaces for local exploitation | Kernel memory corruption and root escalation; difficult remote reach may exist on certain AH transport gateways |
| TUNderflow, CVE-2026-81000 | TUN/TAP; unprivileged user namespaces | Integer underflow leading to heap corruption and root escalation |
| PPPoEject, CVE-2026-68121 | PPPoE; unprivileged user namespaces | Use-after-free leading to kernel memory corruption and root escalation |
| DiagSpill, CVE-2026-74469 | SCTP diagnostics; no namespace requirement | Root escalation and possible remote denial of service when SCTP ASCONF/ADD-IP is enabled |
The shared mitigation stops only three local paths
Red Hat’s bulletin says disabling unprivileged user namespaces blocks local exploitation of DirtyAH6, TUNderflow and PPPoEject. It does not mitigate DiagSpill. Organisations should also check whether the relevant ah6, tun, pppoe, sctp and sctp_diag modules are required.
Blocking a module can remove the attack surface, but it can also break VPNs, virtual machines, containers, broadband links or telecommunications workloads. Patching is the comprehensive answer because it closes the flaw without permanently removing required functionality.
RHEL is only the first layer of the inventory
Red Hat lists RHEL 7, 8, 9 and 10. Products using the RHEL kernel, including RHEL CoreOS and layered OpenShift, OpenStack and Virtualization environments, may also be affected. A container platform can therefore inherit the kernel issue even when the vulnerable code is not present inside an application image.
The bulletin was still marked ongoing at review time, with fixes being expedited. Administrators should use the current Red Hat package advisory for their exact release and confirm that the fixed kernel is running after any required reboot.
Operational priorities
- Map the running kernel. Include hosts beneath container and virtualisation platforms.
- Identify required modules. Do not disable TUN/TAP or SCTP blindly on systems that depend on them.
- Apply the release-specific fix. Follow Red Hat’s live errata and verify the kernel after reboot.
- Use namespaces as a temporary reduction. Understand that it leaves DiagSpill exposed and can disrupt sandboxed applications.
- Prioritise shared hosts. Multi-user systems and developer platforms make a local-to-root path more consequential.
- Review suspicious activity. Investigate unexplained privilege changes, kernel crashes and networking anomalies during the vulnerable period.
The quartet shares a headline, not one mitigation. The safest plan is to patch all four, then use subsystem and namespace controls to reduce exposure while the rollout catches up.
Sources
- Red Hat security bulletin RHSB-2026-011, public date 19 September 2026 at 15:00.
