Loading story…
Researchers disclosed four Linux local privilege-escalation vulnerabilities dubbed DirtyAH6 (CVE-2026-80844), PPPoEject (CVE-2026-81000), TUNderflow (CVE-2026-68121), and DiagSpill (CVE-2026-74469). The flaws, identified through agentic vulnerability hunting, could allow a local attacker to obtain root-level privileges on affected Linux systems.
Oracle Linux issued ELSA-2026-500330 updates for Oracle Linux 7 and 8 systems running Unbreakable Enterprise Kernel packages, addressing all four CVEs. CVE-2026-68121 carries a CVSS v2 score of 10.0, while CVE-2026-74469 is rated high severity with low-privilege requirements; the vendor advisory reported no known exploits at publication. Organizations using affected UEK deployments should prioritize applying the available kernel updates and reboot systems into the patched kernel.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository published a destructive local Linux privilege-escalation proof of concept for DiagSpill (CVE-2026-74469), exploiting an SCTP diagnostic reply-size mismatch to overwrite kernel memory and corrupt page tables. The PoC targets specified Ubuntu 24.04 and Fedora 44 configurations and claims it can modify a worker process's credentials to obtain root access.
A GitHub repository published a destructive local privilege-escalation proof of concept for TUNderflow (CVE-2026-81000). The PoC uses TUN, Open vSwitch, netkit, and VXLAN objects to attempt an out-of-bounds OVS write, corrupt a pipe buffer, and overwrite /etc/pam.d/su; it was tested on specified Fedora 44 and Ubuntu 24.04.4 kernels.
A public proof of concept for CVE-2026-80844 was published, demonstrating a local Linux privilege-escalation path that corrupts socket-buffer metadata through malformed IPv6 AH6 processing and overwrites /etc/pam.d/su to seek root access. The PoC was tested on specified Fedora 43 and Ubuntu 24.04 kernels and warns it can corrupt memory or crash the host.
Oracle Linux released ELSA-2026-500330 for affected Oracle Linux 7 and 8 UEK kernel packages, addressing CVE-2026-68121, CVE-2026-74469, CVE-2026-80844, and CVE-2026-81000. The advisory stated that no known exploits were available.
CVE-2026-68121, CVE-2026-74469, CVE-2026-80844, and CVE-2026-81000 were published as vulnerabilities affecting Linux kernel-related components.
A GitHub repository published PPPoEject, a destructive local Linux privilege-escalation proof of concept for CVE-2026-68121. The exploit abuses a stale PPPoE header pointer after skb-head reallocation to redirect an fdtable entry to a fake file object and execute a controlled callback intended to obtain root privileges.
Research disclosed four Linux local privilege-escalation vulnerabilities, dubbed DirtyAH6, PPPoEject, TUNderflow, and DiagSpill, corresponding respectively to CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. The research said the flaws were found through agentic vulnerability hunting and can yield root privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcegithub.com
Open sourceheyitsas.im
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026
`CVE-2026-31431` is a Linux kernel flaw classified as **CWE-669: Incorrect Resource Transfer Between Spheres** that can enable local privilege escalation to root and, in some cases, bypass isolation boundaries. The Canadian Centre for Cyber Security warned that the impact becomes more severe when the bug is chained with a remote code execution vulnerability, and urged organizations to identify exposed systems, apply vendor fixes, reboot after kernel updates, restrict access, enforce kernel security controls, monitor logs, and segment high-risk or Internet-facing workloads. Vendor and community activity indicates broad exposure across modern Linux platforms. Red Hat lists **RHEL 8**, **RHEL 9**, **RHEL 10**, and corresponding `kernel-rt` packages as affected, while **RHEL 6** and **RHEL 7** are marked not affected because the vulnerable code is absent. Public exploit interest accelerated after Theori published the **"Copy Fail"** technical write-up and proof-of-concept repository, which references testing on **Ubuntu 24.04 LTS**, **Amazon Linux 2023**, **RHEL 10.1**, and **SUSE 16**; Rocky Linux also published related errata, signaling downstream patch availability in enterprise Linux ecosystems.
Jun 29, 2026