RHSB-2026-011 Network Stack Privilege Escalations - Linux Kernel (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469)

Executive Summary

Multiple Important privilege escalation flaws were found in the Linux kernel's network stack: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill). Red Hat has released fixes for many affected product streams and is expediting fixes for the remaining affected products.

Each vulnerability targets a different kernel networking subsystem, but all can allow local privilege escalation to root when their prerequisites are met. DiagSpill (CVE-2026-74469) does not require unprivileged user namespaces or special capabilities and could enable remote denial-of-service in specific SCTP configurations when a local process triggers a diagnostics request. Unprivileged user namespaces provide the ordinary-user attack path for DirtyAH6, TUNderflow, and PPPoEject; appropriately privileged processes or containers may remain able to reach these flaws without creating new user namespaces. Customers should update to a patched kernel as soon as it becomes available.

Environments that do not use the affected kernel functionality (AH6, TUN, PPPoE, SCTP, and sctp_diag) can reduce exposure by disabling it.

The investigation is ongoing and this bulletin will be updated as new information emerges. Log in with your Red Hat account, then click the "Follow" button below to be notified of changes to this bulletin.

Affected Products

The following Red Hat product versions are directly affected:

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Red Hat OpenShift Container Platform

Further, any Red Hat product that relies on the Red Hat Enterprise Linux kernel (including RHEL CoreOS) is also potentially impacted. This includes layered products such as Red Hat OpenShift Container Platform, Red Hat OpenStack Platform, and Red Hat Virtualization.

Please ensure that the underlying Red Hat Enterprise Linux kernel is current in these product environments.

Red Hat assesses the risk to Red Hat OpenShift Container Platform as Low for all four vulnerabilities when using the default security configuration. The default restricted-v2 Security Context Constraints (SCC) restrict the capabilities required to exploit DirtyAH6, TUNderflow, and PPPoEject. Exploitation of DiagSpill requires SCTP and sctp_diag support to be available. This assessment may not apply to workloads granted additional network capabilities or to environments where the affected networking functionality has been explicitly enabled.

Mitigation

Overall Guidance

Disabling the affected kernel functionality can prevent the vulnerable paths from being reached, but it may disrupt necessary workloads and is not a substitute for patching. Disabling unprivileged user namespaces removes the ordinary-user attack path for three flaws (DirtyAH6, TUNderflow, and PPPoEject), but does not protect appropriately privileged processes or mitigate DiagSpill (CVE-2026-74469). Patching is the only comprehensive solution that both fixes the vulnerabilities and maintains full functionality.

Product-Specific Mitigation Steps

Disable Affected Kernel Functionality

If the affected kernel subsystems are not required and are provided as loadable modules, blocking the corresponding modules prevents that code from being loaded. Each module can be blocked independently based on your environment's needs. These steps do not disable functionality compiled directly into the kernel.

Warning: Blocking these modules will prevent the associated functionality from working. Review each module before blocking.

• ah6 (IPsec Authentication Header for IPv6): required for IPv6 IPsec transport mode. Environments without IPv6 IPsec typically do not need this module.
• tun (TUN/TAP virtual network devices): used by VPNs (for example, OpenVPN and userspace WireGuard), container networking, and virtual machine networking. Blocking this module will break these workloads.
• pppoe (PPP over Ethernet): used for DSL/broadband connections. Enterprise server and cloud environments rarely require PPPoE.
• sctp and sctp_diag (Stream Control Transmission Protocol): used in telecommunications and some high-availability configurations. If SCTP is not in use, consider blocking both modules after verifying workload requirements.

To block a module (replace MODULE with the module name):

echo "install MODULE /bin/true" > /etc/modprobe.d/disable-MODULE.conf

If the module is already loaded, unload it:

modprobe -r MODULE

To verify the module is no longer loaded:

lsmod | grep MODULE

A system reboot may be required if the module cannot be unloaded while in use.

Disable Unprivileged User Namespaces

Restricting unprivileged user namespaces removes the ordinary-user attack path for CVE-2026-80844, CVE-2026-81000, and CVE-2026-68121. Processes or containers with the required network capabilities may remain able to reach these flaws. This does not mitigate CVE-2026-74469 (DiagSpill).

Warning: Disabling unprivileged user namespaces may affect container runtimes, sandboxed browsers, and other workloads that depend on them. Verify compatibility before applying.

To disable:

sysctl -w user.max_user_namespaces=0

To persist across reboots:

echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf

Technical Details

CVE-2026-80844 -- DirtyAH6

A validation flaw in IPv6 Authentication Header (AH6) processing allows a malformed routing header to describe more remaining segments than are present. The kernel then derives an invalid memory range while rearranging the header, resulting in an out-of-bounds access. A local unprivileged user can combine user and network namespaces with a crafted IPv6 packet to corrupt kernel memory and escalate privileges; a process with CAP_NET_ADMIN and CAP_NET_RAW over an attacker-controlled network namespace can also reach the flaw. Exploitation requires a complex AH6/XFRM configuration and careful control of timing and memory layout. IPv6 routers or gateways that add AH in transport mode may be remotely crashed, while remote privilege escalation would require substantially more difficult memory grooming on the target.

Affected subsystem: IPv6 AH6/XFRM
Prerequisite: AH6/XFRM support and either unprivileged user/network namespaces or the required network capabilities

CVE-2026-81000 -- TUNderflow

The TUN/TAP driver can mishandle an oversized receive-headroom value propagated through a network-device path. A size calculation wraps, placing packet data beyond the memory allocated for it and allowing subsequent packet processing to corrupt the heap. A local attacker can build the required network configuration through unprivileged user and network namespaces, or reach it from a process with CAP_NET_ADMIN over an attacker-controlled network namespace, and use the corruption to gain root privileges.

Affected subsystem: TUN/TAP driver
Prerequisite: TUN support, a path that propagates oversized receive headroom, and either unprivileged user/network namespaces or CAP_NET_ADMIN

CVE-2026-68121 -- PPPoEject

The PPPoE transmit path retains a location within a packet buffer while invoking lower-device header processing. A lower-device callback can replace the buffer's backing allocation, after which PPPoE metadata updates target the released memory. A local attacker can arrange this condition with a suitable lower-device configuration through unprivileged user and network namespaces, or from a process with CAP_NET_ADMIN over an attacker-controlled network namespace, and use the resulting memory corruption to escalate privileges.

Affected subsystem: PPPoE
Prerequisite: PPPoE support, a lower-device callback that can reallocate the packet buffer, and either unprivileged user/network namespaces or CAP_NET_ADMIN

CVE-2026-74469 -- DiagSpill

SCTP stores the number of peer transports in a field that can wrap to zero for a sufficiently large association. The diagnostics interface trusts that value when sizing a Netlink response, but then emits data for every peer, causing a substantial out-of-bounds write. Unlike the other three flaws in this bulletin, DiagSpill does not require unprivileged user namespaces or special capabilities. A remote denial-of-service also becomes possible when ASCONF/ADD-IP is enabled with SCTP-AUTH or net.sctp.addip_noauth_enable=1 and a local process triggers the diagnostics request; these SCTP options are disabled by default.

Affected subsystem: SCTP diagnostics (sctp_diag)
Prerequisite: SCTP and sctp_diag support (no namespace requirement)

Acknowledgements

Red Hat would like to thank Asim Manizada for responsibly disclosing these vulnerabilities.

References

CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469

Writeup from the researcher: LPE Quartet