RHSB-2026-011 Network Stack Privilege Escalations - Linux Kernel (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469)

Executive Summary

Multiple Important privilege escalation flaws were found in the Linux kernel's network stack: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill). Red Hat is expediting the release of fixes.

Each vulnerability targets a different kernel networking subsystem but all allow a local user to escalate to root privileges. DiagSpill (CVE-2026-74469) is the highest risk, as it does not require unprivileged user namespaces and could enable remote denial-of-service. The remaining three (DirtyAH6, TUNderflow, PPPoEject) require unprivileged user namespaces to exploit locally. Restricting unprivileged user namespaces mitigates these exploits by reducing the attack surface. Customers should update to a patched kernel as soon as it becomes available.

Environments that do not use the affected kernel modules (ah6, tun, pppoe, sctp, sctp_diag) can reduce exposure by disabling or blocking them.

The investigation is ongoing and this bulletin will be updated as new information emerges. Log in with your Red Hat account, then click the "Follow" button below to be notified of changes to this bulletin.

Affected Products

The following Red Hat product versions are directly affected:

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10

Red Hat OpenShift Container Platform: The default restricted-v2 Security Context Constraints (SCC) prevent containers from accessing the capabilities required to exploit CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), and CVE-2026-68121 (PPPoEject). Clusters using the default SCC configuration are at reduced risk for these three vulnerabilities. For CVE-2026-74469 (DiagSpill), SCTP is not enabled by default on OpenShift. Clusters that have not explicitly enabled SCTP support are not exposed to this vulnerability.

Mitigation

Overall Guidance

Blocking the affected kernel modules prevents exploitation of all four vulnerabilities, however it may disable necessary functionality. Disabling unprivileged user namespaces will block local exploitation for three flaws (DirtyAH6, TUNderflow, PPPoEject) but does not mitigate DiagSpill (CVE-2026-74469). Patching is the only comprehensive solution that both fixes the vulnerabilities and maintains full functionality.

Product-Specific Mitigation Steps

Block Affected Kernel Modules (covers all four)

If the affected kernel subsystems are not required, blocking the corresponding modules prevents the vulnerable code from being loaded. Each module can be blocked independently based on your environment's needs.

Warning: Blocking these modules will prevent the associated functionality from working. Review each module before blocking.

• ah6 (IPsec Authentication Header for IPv6): required for IPv6 IPsec transport mode. Environments without IPv6 IPsec typically do not need this module.
• tun (TUN/TAP virtual network devices): used by VPNs (e.g. OpenVPN, WireGuard userspace), container networking, and virtual machine networking. Blocking this module will break these workloads.
• pppoe (PPP over Ethernet): used for DSL/broadband connections. Enterprise server and cloud environments rarely require PPPoE.
• sctp and sctp_diag (Stream Control Transmission Protocol): used in telecommunications and some high-availability configurations. If SCTP is not in use, both modules can be safely blocked.

To block a module (replace MODULE with the module name):

echo "install MODULE /bin/true" > /etc/modprobe.d/disable-MODULE.conf

If the module is already loaded, unload it:

modprobe -r MODULE

To verify the module is no longer loaded:

lsmod | grep MODULE

A system reboot may be required if the module cannot be unloaded while in use.

Disable Unprivileged User Namespaces (covers DirtyAH6, TUNderflow, PPPoEject)

Restricting unprivileged user namespaces prevents local exploitation of CVE-2026-80844, CVE-2026-81000, and CVE-2026-68121. This does not mitigate CVE-2026-74469 (DiagSpill).

Warning: Disabling unprivileged user namespaces may affect container runtimes, sandboxed browsers, and other workloads that depend on them. Verify compatibility before applying.

To disable:

sysctl -w user.max_user_namespaces=0

To persist across reboots:

echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf

Technical Details

CVE-2026-80844 -- DirtyAH6

A validation bypass in the IPv6 Authentication Header (AH6) processing function allows out-of-bounds memory access. The segments_left field in an IPv6 Routing Header is not properly validated against the actual number of segments, enabling approximately 4KB of backwards pointer arithmetic via crafted IPv6 packets. A local attacker with access to unprivileged user namespaces can exploit this to corrupt kernel memory and escalate privileges. On IPv6 routers and gateways with AH transport mode enabled, this flaw may also be reachable remotely, though remote exploitation is considered significantly more difficult.

Affected subsystem: IPv6 AH6/XFRM
Prerequisite: AH6/XFRM support, unprivileged user namespaces (for local exploitation)
Affected kernel versions: 2.6.12 through 7.1.12

CVE-2026-81000 -- TUNderflow

An integer underflow in the TUN/TAP driver occurs when processing oversized headroom requests. When a network namespace propagates a headroom value exceeding 4KB (possible through configurations involving netkit, VXLAN, or Open vSwitch), an internal size calculation underflows, causing network packet data to be written outside its allocated buffer. A local attacker with unprivileged user namespace access can exploit this heap overflow to achieve root privileges.

Affected subsystem: TUN/TAP driver
Prerequisite: TUN support, unprivileged user namespaces
Affected kernel versions: 4.6 through 7.2.3

CVE-2026-68121 -- PPPoEject

A use-after-free vulnerability in the PPPoE implementation occurs when the pppoe_sendmsg() function retains a pointer to network packet data across an operation that can reallocate the underlying memory. If the device callback triggers a reallocation (possible through GRE, IP6GRE, or team/bonding configurations), the stale pointer is used for subsequent writes, corrupting freed memory. A local attacker with unprivileged user namespace access can exploit this to escalate to root.

Affected subsystem: PPPoE
Prerequisite: PPPoE support, unprivileged user namespaces
Affected kernel versions: 2.6.12 through 7.1.5

CVE-2026-74469 -- DiagSpill

An integer overflow in the SCTP diagnostics interface occurs when the number of peer transports for an association exceeds the 16-bit counter limit (65,536). The counter wraps to zero, causing the diagnostic dump to allocate a zero-length buffer but copy all transport entries, writing approximately 8MB beyond the intended buffer boundary. Unlike the other three flaws in this bulletin, DiagSpill does not require unprivileged user namespaces. If SCTP is configured with ASCONF/ADD-IP support, this flaw may also be remotely triggerable as a denial of service.

Affected subsystem: SCTP diagnostics (sctp_diag)
Prerequisite: SCTP and sctp_diag modules (no namespace requirement)
Affected kernel versions: 4.7 through 7.1.7

Acknowledgements

Red Hat would like to thank Asim Manizada for responsibly disclosing these vulnerabilities.

References

CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469

Writeup from the researcher: LPE Quartet