CVE-2026-80844Patch

MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

4.3/ 10 priority

Sources & remediation

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 16 mentions across 8 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 3 signals
  • PoC mentioned or linked in 7 signals
  • Patch or workaround mentioned in 10 signals
  • Technical details provided in 14 signals
  • Disclosure: 3 classified signals
  • Peaked 7d ago at 5 mentions (2026-09-18); latest day: 1
  • 16 total mentions across 8 days

Deep dive

Activity timeline16 mentions / 8d
01345Mentions · 2026-09-18: 5Mentions · 2026-09-19: 4Mentions · 2026-09-22: 2Mentions · 2026-09-23: 1Mentions · 2026-09-30: 1Mentions · 2026-10-02: 1Mentions · 2026-10-09: 1Mentions · 2026-10-10: 1PoC Mentioned / Linked · 2026-09-18: 2PoC Mentioned / Linked · 2026-09-19: 3PoC Mentioned / Linked · 2026-09-22: 2Exploit Tool / Code · 2026-09-18: 1Exploit Tool / Code · 2026-09-19: 2Patch / Workaround · 2026-09-18: 4Patch / Workaround · 2026-09-19: 2Patch / Workaround · 2026-09-22: 2Patch / Workaround · 2026-10-02: 1Patch / Workaround · 2026-10-10: 1Technical Details · 2026-09-18: 5Technical Details · 2026-09-19: 4Technical Details · 2026-09-22: 2Technical Details · 2026-09-23: 1Technical Details · 2026-10-02: 1Technical Details · 2026-10-09: 109-1809-1909-2209-2309-3010-0210-0910-10
Signal classification5 categories
Patch
531.3%
PoC
425.0%
Disclosure
318.8%
Exploit
318.8%
General
16.3%
Referenced assets12 URLs
Classification over time
DateTotalLabels
2026-09-185
Disclosure1Exploit1Patch2PoC1
2026-09-194
Exploit2Patch1PoC1
2026-09-222
PoC2
2026-09-231
Disclosure1
2026-09-301
General1
2026-10-021
Patch1
2026-10-091
Disclosure1
2026-10-101
Patch1
Full discourse16 posts
  • elhacker.NET@elhackernet
    Disclosure

    Cuatro fallos en el núcleo de Linux permiten acceso root Se han revelado cuatro nuevas vulnerabilidades en el núcleo de Linux ( CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 y CVE-2026-74469 ) https://blog.elhacker.net/2026/09/cuatro-fallos-en-el-nucleo-de-linux.html

    Post summary

    The text announces four newly disclosed Linux kernel vulnerabilities (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) that allow root access, focusing on the disclosure of their existence without additional exploitation or remediation details.

    1701203497.7K
    142.5K followersView on X
  • Ryx@PadhiyarRushi
    Exploit

    Four Linux local-root vulns published with working PoCs. DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Write-up + exploits dropped after coordinated disclosure. https://heyitsas.im/posts/lpe-quartet/ https://www.openwall.com/lists/oss-security/2026/09/18/3 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #KernelSecurity #PrivilegeEscalation

    Post summary

    The tweet announces the coordinated disclosure of four Linux local privilege escalation vulnerabilities, highlighting that functional exploit code ('exploits dropped') and proof-of-concepts have been published alongside a technical write-up.

    2342121958.9K
    954 followersView on X
  • Ryx@PadhiyarRushi
    Exploit

    DirtyAH6 PoC repo is live!! CVE-2026-80844: IPv6 AH6 routing-header validation flaw → kernel memory corruption → local root (unprivileged user namespaces). Destructive PoC; run only in disposable lab VMs. https://github.com/manizada/DirtyAH6 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #KernelSecurity

    Post summary

    The tweet announces the release of a destructive proof-of-concept exploit for CVE-2026-80844, a kernel memory corruption vulnerability, and provides a link to the GitHub repository containing the exploit code.

    0301971.3K
    954 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Exploit

    🚨 Linux kernel'de 4 kritik LPE açığı için public exploit yayınlandı! CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 ve CVE-2026-74469 için çalışan PoC / Exploit github üzerinden yayınlandı. Açıklar; IPsec AH6, TUN/TAP, PPPoE ve SCTP bileşenlerindeki bellek güvenliği hatalarından kaynaklanıyor ve yerel kullanıcıların root yetkisine yükselmesine olanak sağlıyor. 🔴 CVE-2026-74469: 8.8 CVSS 🔴 CVE-2026-81000: 7.8 CVSS 🔴 CVE-2026-68121: 7.8 CVSS ⚠️ CVE-2026-80844: CVSS analizi bekliyor İlk 3 açıkta unprivileged user namespace gerekiyor. CVE-2026-74469 ise bu gereksinime sahip değil. 👉 PoC / Exploit'ler şöyle: DirtyAH6 — CVE-2026-80844: https://github.com/manizada/DirtyAH6 TUNderflow — CVE-2026-81000: https://github.com/manizada/TUNderflow PPPoEject — CVE-2026-68121: https://github.com/manizada/PPPoEject DiagSpill — CVE-2026-74469: https://github.com/manizada/DiagSpill Şu ana kadar aktif saldırılarda kullanıldığına dair doğrulanmış bir bulgu bulunmuyor. Public exploit yayınlandığı için güncel kernel/security update'lerinin uygulanması mutlaka gerekli.

    Post summary

    The post announces publicly released exploit code for four Linux kernel local privilege escalation vulnerabilities, provides proof‑of‑concept links and CVSS scores, urges applying kernel security updates, and notes no evidence of active exploitation.

    040154910
    2.5K followersView on X
  • 嶋田大貴@shimarin
    Patch

    またLinuxカーネルのLPE脆弱性いくつか出てるな。 CVE-2026-80844,81000,68121,74469 非特権ユーザーが攻撃面を露出させるのにUnprivileged User Namespaceを使うのはもう定番なのでrootlessな隔離環境を使わないなら kernel.unprivileged_userns_clone=0 しておくのがいいね。

    Post summary

    The tweet lists several Linux kernel LPE CVEs and advises mitigating them by disabling unprivileged user namespace cloning via kernel.unprivileged_userns_clone=0 if not using rootless isolation.

    01093929
    4.7K followersView on X
  • OS開発者@hacker_infra
    PoC

    いきなり4つのLPEのPoCが公開されている Red hatにメールで報告済み 緩和策 CVE-2026-80844 (DirtyAH6): The vulnerability requires the IPv6 AH6/XFRM path. On systems where IPv6 is not required, IPv6 can be disabled at boot: grubby --update-kernel=ALL --args="ipv6.disable=1" A reboot is required. CVE-2026-81000 (TUNderflow): On systems that do not require TUN/TAP, the tun kernel module can be disabled: echo "install tun /bin/true" > /etc/modprobe.d/disable-tun.conf CVE-2026-68121 (PPPoEject): On systems that do not require PPPoE, the pppoe kernel module can be disabled: echo "install pppoe /bin/true" > /etc/modprobe.d/disable-pppoe.conf CVE-2026-74469 (DiagSpill): On systems that do not require SCTP, the sctp kernel module can be disabled: echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf https://seclists.org/oss-sec/2026/q3/822

    Post summary

    The text announces the public release of four Local Privilege Escalation PoCs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) reported to Red Hat, and provides specific kernel module/workaround mitigations for each, but does not name a specific exploit tool or claim active exploitation in the wild.

    04090471
    2.9K followersView on X
  • OS開発者@hacker_infra
    Disclosure

    9/18以降に追っているのは正確にはLPE 8件です。 CVE-2026-80844 CVE-2026-81000 CVE-2026-68121 CVE-2026-74469 CVE-2026-74753 CVE-2026-52910 CVE-2026-80521 CVE未採番:RustyTux / strparser・ESP-in-TCP race LPE 9/23まで、これ全部緩和策がわかるものとRed hatに報告した。異常すぎる密度だよ。

    Post summary

    The post discloses eight local privilege escalation vulnerabilities tracked since September 18 2026 (including an unassigned race‑condition LPE in RustyTux/strparser/ESP‑in‑TCP) and notes that mitigations were understood and reported to Red Hat by September 23, without providing PoC, exploit code, or evidence of active exploitation.

    00071562
    2.9K followersView on X
  • OS開発者@hacker_infra
    PoC

    red hatで正式に受理されてる。 緩和策は専用ページに合ったはず。 Hi OS開発者, Your request PSIRTSUPT-24215: Public LPE PoCs for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469 has been resolved. This request is now closed. If you have a new security concern or need further assistance, please reach out to us using one of the following options: • Initiate a new email thread to: secalert@redhat.com • Create a new request directly from the Jira portal: https://redhat.atlassian.net/servicedesk/customer/portal/68 Please note: Do not reply to this thread for new issues, as it has already been closed Thank you, Red Hat Product Security

    Post summary

    The text describes a closed Red Hat support request regarding public LPE PoCs for four CVEs, noting that mitigations are available on a dedicated page.

    00021279
    2.9K followersView on X
  • Renich³@Renich
    Patch

    @P_Pervert RHEL: RHSA-2026:71232 https://access.redhat.com/security/cve/cve-2026-80844 Rocky: RLSA-2026:71232 https://errata.rockylinux.org/RLSA-2026:71232 Revisa las fechas. ¬_¬... 24 horas antes en CentOS Stream/RHEL compadre. Discutes para ganar, no para descubrir la verdad...

    Post summary

    The post cites Red Hat and Rocky Linux security advisories and comments that CentOS Stream/RHEL information appeared 24 hours earlier. It provides no PoC, exploit details, active-exploitation claim, or technical description of the vulnerability.

    1000074
    986 followersView on X
  • Elish@P_Pervert
    Disclosure

    @Renich Uno es el CVE-2026-80844 que tiene que ver con un escalado de privilegios por red, el otro ya ví que ya lo solucionaron ayer, no me había fijado hasta el lunes estaba aún activo, por cierto las vulnerabilidades críticas se resuelven primero e RH y luego ya pasan a CentOS.

    Post summary

    El texto identifica CVE-2026-80844 y aporta el detalle técnico de que está relacionado con un escalado de privilegios por red. No menciona una PoC, una herramienta de explotación ni explotación activa, y la solución mencionada se refiere a otra vulnerabilidad.

    1000071
    115 followersView on X
  • Keith Adler@keithadler
    Patch

    Reviewed with Claude: About 1 in 5 credit AI help in the commit trailers. What AI was good at: spotting a missing bounds check, a missing lock or a refcount slip in old, rarely audited code. The standouts: - A 2005 IPv6 AH bug (CVE-2026-80844). An unchecked segments_left=255 makes the kernel memmove 4,064 bytes from before its buffer. A code comment claimed it was already verified. Raw packets bypass that check. Sat there ~20 years. - A 2006 RPC GSS client bug (CVE-2026-89541). offset + opaque_len > len can wrap around, so a hostile NFS server gets past the bounds check. - Five BPF verifier fixes credited to Nicholas Carlini. The best one lets a plain allocation into a per-CPU pointer field, which the commit says gives arbitrary kernel read/write. (He has an Anthropic address, so weigh that.) - An NFS-over-RDMA heap overflow (CVE-2026-89530). Replies bigger than a fixed buffer were copied in with no size check. - nfsd refcount bugs a remote NFSv4 client can race, plus SMB client heap overflow and out-of-bounds read bugs that need a malicious server. The caveat: five qdisc fixes look impressive but are one MTU-overflow pattern. One reporter found it, a human maintainer fixed it as a single patch series, and the fixes are only clamps. Not five findings. Reality check: nothing here is unauthenticated remote code execution on a default install. Many of the 1,313 are cosmetic, like a debugfs log message. Recommendation: Good tools, modest findings. Patch anyway.

    Post summary

    The text reviews multiple kernel CVEs identified by AI, provides technical descriptions of each, and advises patching despite the findings being modest and not RCE on default installs.

    00000664
    136 followersView on X
  • Manuel Flores "Not giving away Crypto"@manuelfr51
    General

    @CloudLinuxOS What's the current CL8 kernel fix status for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469?

    Post summary

    Tweet asks for current CL8 kernel fix status for four CVE identifiers without providing any vulnerability details, patches, or exploitation information.

    0000032
    461 followersView on X
  • BT Haberler@BTHaberler
    PoC

    Bir Araştırmacı, Yapay Zeka Yardımıyla Bulduğu Dört Linux Çekirdeği Açığı İçin Çalışan İstismar Kodunu Yayınladı! Güvenlik araştırmacısı Asim Manizada, yapay zeka destekli bir süreçle bulduğunu belirttiği dört Linux çekirdeği açığı için (DirtyAH6/CVE-2026-80844, TUNderflow/CVE-2026-81000, PPPoEject/CVE-2026-68121, DiagSpill/CVE-2026-74469) çalışan istismar kodunu kamuya yayınladı; hepsi çekirdeğin ağ kodunda bulunan bellek güvenliği açıkları ve yerel kullanıcılara root erişimi sağlıyor. • Açıklar sırasıyla IPv6 IPsec AH kodu, TUN/TAP sanal ağ cihazları, PPPoE kodu ve SCTP tanı kodunda bulunuyor; ilk tam düzeltmeler 5.10.270'ten 7.2.4'e kadar çeşitli çekirdek sürümlerinde mevcut. • Henüz gerçek saldırılarda kullanıldığına dair kanıt yok, ancak çalışan istismar kodunun kamuya açık hale gelmesi eski çekirdek çalıştıran sistemler için riski artırıyor. Tek bir araştırmacının yapay zeka yardımıyla aynı anda dört farklı çekirdek açığı bulup istismar kodu yazabilmesi, güvenlik açığı keşfinin hızının yapay zeka araçlarıyla ne kadar arttığını, savunma tarafının da aynı hızla yama uygulaması gerektiğini gösteriyor. #SiberGüvenlik #Linux #YapayZeka

    Post summary

    A security researcher published working exploit code for four Linux kernel vulnerabilities discovered via AI, noting patches are available but no active exploitation observed.

    0000034
    44 followersView on X
  • miniMIDI Kinri@kinrimini22223
    Patch

    DirtyAH6 CVE-2026-80844 はあまり過度に心配する必要はなさそう。いつも通りカーネル更新しておけばOK。 概要:非特権ユーザーネームスペース有効時にローカル攻撃が可能で、リモートからは特定条件でのクラッシュ(DoS)に留まるIPv6 IPsecの脆弱性。

    Post summary

    The tweet discusses CVE-2026-80844, an IPv6 IPsec vulnerability, and emphasizes that a standard kernel update is sufficient to address it, suggesting minimal risk.

    0000071
    117 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    PoC

    News: Asim Manizada published local-root PoCs for four Linux kernel bugs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Hits unpatched multi-user hosts. Patch to a fixed kernel (6.12.109+ or your distro advisory). https://www.infosectoday.io/public-exploits-released-for-four-linux-kernel-flaws-that-enable-local-root/

    Post summary

    The post announces published local-root PoCs for four Linux kernel CVEs and recommends patching to a fixed kernel. No active exploitation is reported.

    0000069
    3.0K followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Four Linux kernel bugs give local root: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Hits many kernels. Update to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4. https://www.openwall.com/lists/oss-security/2026/09/18/3

    Post summary

    The announcement discloses four Linux kernel local privilege escalation vulnerabilities and urges users to update to patched kernel versions (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4). No exploit code or active exploitation is mentioned.

    0000066
    3.0K followersView on X

Explore more