Four more Linux local-root bugs, public tests, and a Monday that is still the other three

The kernel trio on CISA's list is due tomorrow, September 21. We wrote that Saturday. Those three are already being used. Friday's other kernel story did not make the catalog, and it should still be on a Sunday list: four more local-root bugs, with working test code now public.

Asim Manizada reported them to the kernel team in July. He published the write-up on September 18 after distributions had time to ship fixes. The Hacker News carried it the same day. The names are DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). There are no reports of real-world use. The tests are his, tuned to specific builds, and they can panic a box. That is why they belong on a lab VLAN, not a shared runner. Public code still changes the weekend math on any Linux host where a low-privilege account already exists.

What they are, without the recipe

All four are memory-safety mistakes in networking code. The underlying bugs are old, on the order of a decade or two. We are not going to walk the writes. The operational split is enough.

Three of them (DirtyAH6, TUNderflow, PPPoEject) need unprivileged user namespaces for an ordinary local user to reach them. A lot of distros leave those on. Turn that off and you close the easy path. You do not close a process that already has network-admin rights, and you do not close DiagSpill. DiagSpill needs SCTP and the sctp_diag reporting path. No namespace required. Manizada says two of the four can be poked over the network in narrow cases, mostly as a crash: DirtyAH6 on an IPv6 router that adds an IPsec Authentication Header in transport mode, DiagSpill only with SCTP options that are off by default. He reached remote root with DirtyAH6 only in his own lab after shaping memory first, and he called that path extremely difficult from a remote seat alone. Treat that as a research note, not a reason to wait.

Not on KEV. Still a Monday kernel.

CISA listed CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 because someone is already using them. These four are a different pile: fixed upstream, exploits public, no confirmed campaign. Do not let the extra names displace tomorrow's trio. Do not ignore them on a multi-tenant host either. Shared CI, hosting, student labs, and jump boxes are where a local account becomes root.

The first mainline kernels that carry all four fixes are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. You probably do not run those numbers. You run a distro kernel. Check the vendor advisory, not a screenshot of that list.

What we would do before the Monday reboot

• Vendor kernel that claims all four CVEs, then uname -r after the reboot. Same window as the KEV trio if you can stand one outage.
• If you cannot patch tonight, turn off unprivileged user namespaces. That is three of four. It is not DiagSpill.
• If you do not use SCTP, AH6, PPPoE, or TUN/TAP, do not load them. Manizada still says patch, because other paths may exist.
• Tomorrow is still CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. Those stay first.

Bottom line

Public local-root tests on old networking code are a shared-host problem dressed up as a research dump. Forensic Five reviews the kernel that is actually running, including the one nobody rebooted because Friday looked quiet. From St. Albert, Alberta. Apply the vendor kernel. Then look at tomorrow's three names again.