CVE-2026-74469PoC

MEDIUMCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
11 mentions across 6 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 3 signals
PoC mentioned or linked in 7 signals
Patch or workaround mentioned in 6 signals
Technical details provided in 9 signals
Peaked 5d ago at 4 mentions (2026-09-18); latest day: 1
11 total mentions across 6 days

Deep dive

Activity timeline11 mentions / 6d

Signal classification5 categories

PoC

545.5%

Exploit

218.2%

Patch

218.2%

Disclosure

19.1%

General

19.1%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-18	4	Disclosure1Exploit1Patch1PoC1
2026-09-19	2	PoC2
2026-09-22	2	Exploit1PoC1
2026-09-23	1	Patch1
2026-09-30	1	General1
2026-10-05	1	PoC1

Full discourse11 posts

elhacker.NET@elhackernet46d
Disclosure
Cuatro fallos en el núcleo de Linux permiten acceso root Se han revelado cuatro nuevas vulnerabilidades en el núcleo de Linux ( CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 y CVE-2026-74469 ) https://blog.elhacker.net/2026/09/cuatro-fallos-en-el-nucleo-de-linux.html
Post summary
The text announces four new Linux kernel CVEs that allow root access but provides no specific exploit details, patch information, active exploitation claims, or PoC references. It serves primarily as a disclosure/announcement directing readers to an external blog post for further details.
1701203497.7K
142.5K followersView on X
Ryx@PadhiyarRushi45d
PoC
Four Linux local-root vulns published with working PoCs. DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Write-up + exploits dropped after coordinated disclosure. https://heyitsas.im/posts/lpe-quartet/ https://www.openwall.com/lists/oss-security/2026/09/18/3 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #KernelSecurity #PrivilegeEscalation
Post summary
The tweet discloses four Linux local-root vulnerabilities (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) and notes that working proof-of-concept exploits have been released, providing links to a write-up and the OSS-security mailing list.
2342121958.9K
954 followersView on X
Rıdvan Yağlı@ridvanyagli46d
Exploit
🚨 Linux kernel'de 4 kritik LPE açığı için public exploit yayınlandı! CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 ve CVE-2026-74469 için çalışan PoC / Exploit github üzerinden yayınlandı. Açıklar; IPsec AH6, TUN/TAP, PPPoE ve SCTP bileşenlerindeki bellek güvenliği hatalarından kaynaklanıyor ve yerel kullanıcıların root yetkisine yükselmesine olanak sağlıyor. 🔴 CVE-2026-74469: 8.8 CVSS 🔴 CVE-2026-81000: 7.8 CVSS 🔴 CVE-2026-68121: 7.8 CVSS ⚠️ CVE-2026-80844: CVSS analizi bekliyor İlk 3 açıkta unprivileged user namespace gerekiyor. CVE-2026-74469 ise bu gereksinime sahip değil. 👉 PoC / Exploit'ler şöyle: DirtyAH6 — CVE-2026-80844: https://github.com/manizada/DirtyAH6 TUNderflow — CVE-2026-81000: https://github.com/manizada/TUNderflow PPPoEject — CVE-2026-68121: https://github.com/manizada/PPPoEject DiagSpill — CVE-2026-74469: https://github.com/manizada/DiagSpill Şu ana kadar aktif saldırılarda kullanıldığına dair doğrulanmış bir bulgu bulunmuyor. Public exploit yayınlandığı için güncel kernel/security update'lerinin uygulanması mutlaka gerekli.
Post summary
The post announces the release of public exploit code for four Linux kernel LPE vulnerabilities, providing specific tool names and GitHub links, while noting no confirmed active exploitation.
040154910
2.5K followersView on X
OS開発者@hacker_infra46d
PoC
いきなり4つのLPEのPoCが公開されている Red hatにメールで報告済み緩和策 CVE-2026-80844 (DirtyAH6): The vulnerability requires the IPv6 AH6/XFRM path. On systems where IPv6 is not required, IPv6 can be disabled at boot: grubby --update-kernel=ALL --args="ipv6.disable=1" A reboot is required. CVE-2026-81000 (TUNderflow): On systems that do not require TUN/TAP, the tun kernel module can be disabled: echo "install tun /bin/true" > /etc/modprobe.d/disable-tun.conf CVE-2026-68121 (PPPoEject): On systems that do not require PPPoE, the pppoe kernel module can be disabled: echo "install pppoe /bin/true" > /etc/modprobe.d/disable-pppoe.conf CVE-2026-74469 (DiagSpill): On systems that do not require SCTP, the sctp kernel module can be disabled: echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf https://seclists.org/oss-sec/2026/q3/822
Post summary
The post announces that four Linux privilege escalation PoCs have been published and reports them to Red Hat, then lists mitigation commands for disabling affected kernel modules.
04090471
2.9K followersView on X
!Manan@0xManan29d
PoC
No user namespace. No capability. Just SCTP compiled in - and an unprivileged user owns the box. CVE-2026-74469 (DiagSpill). SCTP's peer `transport_count` is 16-bit, so the 65,536th transport wraps it to zero. Chain: open 81,920 SCTP peer transports → counter wraps → `sctp_diag` reserves 0 bytes for the peer list but copies all of it → ~8 MiB kernel heap OOB write → groom PMD entries to map host RAM → rewrite a worker's cred struct → drop a sudoers rule → `sudo` root. Uniquely needs no userns and no CAP - if `sctp_diag` is reachable, it's reachable. Hits 4.7 → 7.1.7. PoC: https://github.com/manizada/DiagSpill Writeup: https://heyitsas.im/posts/lpe-quartet Which of your kernels still ship sctp_diag? #Linux #LPE #CVE #Infosec
Post summary
The tweet discloses a Linux kernel local privilege escalation (CVE‑2026‑74469) via an SCTP diag heap overflow, provides a detailed exploitation chain, and links to a public proof‑of‑concept and writeup, affecting kernel versions 4.7 through 7.1.7, with no patch mentioned.
10073670
2.3K followersView on X
OS開発者@hacker_infra41d
Patch
9/18以降に追っているのは正確にはLPE 8件です。 CVE-2026-80844 CVE-2026-81000 CVE-2026-68121 CVE-2026-74469 CVE-2026-74753 CVE-2026-52910 CVE-2026-80521 CVE未採番：RustyTux / strparser・ESP-in-TCP race LPE 9/23まで、これ全部緩和策がわかるものとRed hatに報告した。異常すぎる密度だよ。
Post summary
The author discloses a list of eight future-dated CVEs (2026) and one unassigned vulnerability, all classified as Local Privilege Escalations, and emphasizes that mitigations are known for all issues and have been reported to Red Hat.
00071562
2.9K followersView on X
OS開発者@hacker_infra43d
PoC
red hatで正式に受理されてる。緩和策は専用ページに合ったはず。 Hi OS開発者, Your request PSIRTSUPT-24215: Public LPE PoCs for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469 has been resolved. This request is now closed. If you have a new security concern or need further assistance, please reach out to us using one of the following options: • Initiate a new email thread to: secalert@redhat.com • Create a new request directly from the Jira portal: https://redhat.atlassian.net/servicedesk/customer/portal/68 Please note: Do not reply to this thread for new issues, as it has already been closed Thank you, Red Hat Product Security
Post summary
The text is a notification regarding the resolution of a request for public Local Privilege Escalation (LPE) PoCs for multiple CVEs, indicating the availability or closure of the PoC request.
00021279
2.9K followersView on X
Manuel Flores "Not giving away Crypto"@manuelfr5134d
General
@CloudLinuxOS What's the current CL8 kernel fix status for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469?
Post summary
The author queries CloudLinux OS regarding the current kernel fix status for four specific CVEs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) without providing technical details or exploit information.
0000032
461 followersView on X
BT Haberler@BTHaberler42d
Exploit
Bir Araştırmacı, Yapay Zeka Yardımıyla Bulduğu Dört Linux Çekirdeği Açığı İçin Çalışan İstismar Kodunu Yayınladı! Güvenlik araştırmacısı Asim Manizada, yapay zeka destekli bir süreçle bulduğunu belirttiği dört Linux çekirdeği açığı için (DirtyAH6/CVE-2026-80844, TUNderflow/CVE-2026-81000, PPPoEject/CVE-2026-68121, DiagSpill/CVE-2026-74469) çalışan istismar kodunu kamuya yayınladı; hepsi çekirdeğin ağ kodunda bulunan bellek güvenliği açıkları ve yerel kullanıcılara root erişimi sağlıyor. • Açıklar sırasıyla IPv6 IPsec AH kodu, TUN/TAP sanal ağ cihazları, PPPoE kodu ve SCTP tanı kodunda bulunuyor; ilk tam düzeltmeler 5.10.270'ten 7.2.4'e kadar çeşitli çekirdek sürümlerinde mevcut. • Henüz gerçek saldırılarda kullanıldığına dair kanıt yok, ancak çalışan istismar kodunun kamuya açık hale gelmesi eski çekirdek çalıştıran sistemler için riski artırıyor. Tek bir araştırmacının yapay zeka yardımıyla aynı anda dört farklı çekirdek açığı bulup istismar kodu yazabilmesi, güvenlik açığı keşfinin hızının yapay zeka araçlarıyla ne kadar arttığını, savunma tarafının da aynı hızla yama uygulaması gerektiğini gösteriyor. #SiberGüvenlik #Linux #YapayZeka
Post summary
The text announces the public release of working exploit code for four Linux kernel vulnerabilities while noting fixed versions exist and there is no evidence of active exploitation yet. It is classified as 'Exploit' because the availability of functional exploitation code is the central takeaway, taking precedence over the patch or disclosure information.
0000034
44 followersView on X
Venkata Satish Guttula 🛰️@snakeyesV146d
PoC
News: Asim Manizada published local-root PoCs for four Linux kernel bugs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Hits unpatched multi-user hosts. Patch to a fixed kernel (6.12.109+ or your distro advisory). https://www.infosectoday.io/public-exploits-released-for-four-linux-kernel-flaws-that-enable-local-root/
Post summary
Asim Manizanda released proof‑of‑concept code for four Linux kernel local privilege‑escalation flaws (CVE‑2026‑80844, CVE‑2026‑81000, CVE‑2026‑68121, CVE‑2026‑74469) affecting unpatched multi‑user systems, with a patch available in kernel 6.12.109+ (or via distro advisories).
0000069
3.0K followersView on X
Venkata Satish Guttula 🛰️@snakeyesV146d
Patch
News: Four Linux kernel bugs give local root: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Hits many kernels. Update to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4. https://www.openwall.com/lists/oss-security/2026/09/18/3
Post summary
The text announces four Linux kernel vulnerabilities that allow local root access and provides the specific kernel versions to update to for remediation.
0000066
3.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-74469

Ryx[verified]@PadhiyarRushiPoC

The tweet discloses four Linux local-root vulnerabilities (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) and notes that working proof-of-concept exploits have been released, providing links to a write-up and the OSS-security mailing list.

Rıdvan Yağlı[verified]@ridvanyagliExploit

The post announces the release of public exploit code for four Linux kernel LPE vulnerabilities, providing specific tool names and GitHub links, while noting no confirmed active exploitation.

OS開発者[verified]@hacker_infraPoC

The post announces that four Linux privilege escalation PoCs have been published and reports them to Red Hat, then lists mitigation commands for disabling affected kernel modules.

!Manan[verified]@0xMananPoC

The tweet discloses a Linux kernel local privilege escalation (CVE‑2026‑74469) via an SCTP diag heap overflow, provides a detailed exploitation chain, and links to a public proof‑of‑concept and writeup, affecting kernel versions 4.7 through 7.1.7, with no patch mentioned.

OS開発者[verified]@hacker_infraPatch

The author discloses a list of eight future-dated CVEs (2026) and one unassigned vulnerability, all classified as Local Privilege Escalations, and emphasizes that mitigations are known for all issues and have been reported to Red Hat.

OS開発者[verified]@hacker_infraPoC

The text is a notification regarding the resolution of a request for public Local Privilege Escalation (LPE) PoCs for multiple CVEs, indicating the availability or closure of the PoC request.

BT Haberler[verified]@BTHaberlerExploit

The text announces the public release of working exploit code for four Linux kernel vulnerabilities while noting fixed versions exist and there is no evidence of active exploitation yet. It is classified as 'Exploit' because the availability of functional exploitation code is the central takeaway, taking precedence over the patch or disclosure information.

Venkata Satish Guttula 🛰️[verified]@snakeyesV1PoC

Asim Manizanda released proof‑of‑concept code for four Linux kernel local privilege‑escalation flaws (CVE‑2026‑80844, CVE‑2026‑81000, CVE‑2026‑68121, CVE‑2026‑74469) affecting unpatched multi‑user systems, with a patch available in kernel 6.12.109+ (or via distro advisories).