VulnSocial

CVE-2026-81000PoC

MEDIUMCVSS 7.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 10 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 6 signals
  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 7 signals
  • Disclosure: 1 classified signal
  • Peaked 4d ago at 4 mentions (2026-09-18); latest day: 1
  • 10 total mentions across 5 days

Deep dive

Activity timeline10 mentions / 5d
01234Mentions · 2026-09-18: 4Mentions · 2026-09-19: 2Mentions · 2026-09-22: 2Mentions · 2026-09-23: 1Mentions · 2026-09-30: 1PoC Mentioned / Linked · 2026-09-18: 2PoC Mentioned / Linked · 2026-09-19: 2PoC Mentioned / Linked · 2026-09-22: 2Exploit Tool / Code · 2026-09-18: 1Patch / Workaround · 2026-09-18: 3Patch / Workaround · 2026-09-19: 1Patch / Workaround · 2026-09-22: 2Patch / Workaround · 2026-09-23: 1Technical Details · 2026-09-18: 3Technical Details · 2026-09-19: 1Technical Details · 2026-09-22: 2Technical Details · 2026-09-23: 109-1809-1909-2209-2309-30
Signal classification5 categories
PoC
550.0%
Patch
220.0%
Disclosure
110.0%
Exploit
110.0%
General
110.0%
Referenced assets10 URLs
Classification over time
DateTotalLabels
2026-09-184
Disclosure1Exploit1Patch1PoC1
2026-09-192
PoC2
2026-09-222
PoC2
2026-09-231
Patch1
2026-09-301
General1
Full discourse10 posts
  • elhacker.NET@elhackernet
    Disclosure

    Cuatro fallos en el núcleo de Linux permiten acceso root Se han revelado cuatro nuevas vulnerabilidades en el núcleo de Linux ( CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 y CVE-2026-74469 ) https://blog.elhacker.net/2026/09/cuatro-fallos-en-el-nucleo-de-linux.html

    Post summary

    The text announces four new Linux kernel vulnerabilities (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) with root-access potential and links to a blog post, but provides no PoC, exploit, patch, or technical details in the tweet itself.

    1701203497.7K
    142.5K followersView on X
  • Ryx@PadhiyarRushi
    PoC

    Four Linux local-root vulns published with working PoCs. DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Write-up + exploits dropped after coordinated disclosure. https://heyitsas.im/posts/lpe-quartet/ https://www.openwall.com/lists/oss-security/2026/09/18/3 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #KernelSecurity #PrivilegeEscalation

    Post summary

    The tweet announces four Linux local privilege escalation vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) and states that working proof-of-concept exploits have been published via coordinated disclosure. No patches, active exploitation, or specific exploit tool names are mentioned.

    2342121958.9K
    954 followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Exploit

    🚨 Linux kernel'de 4 kritik LPE açığı için public exploit yayınlandı! CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 ve CVE-2026-74469 için çalışan PoC / Exploit github üzerinden yayınlandı. Açıklar; IPsec AH6, TUN/TAP, PPPoE ve SCTP bileşenlerindeki bellek güvenliği hatalarından kaynaklanıyor ve yerel kullanıcıların root yetkisine yükselmesine olanak sağlıyor. 🔴 CVE-2026-74469: 8.8 CVSS 🔴 CVE-2026-81000: 7.8 CVSS 🔴 CVE-2026-68121: 7.8 CVSS ⚠️ CVE-2026-80844: CVSS analizi bekliyor İlk 3 açıkta unprivileged user namespace gerekiyor. CVE-2026-74469 ise bu gereksinime sahip değil. 👉 PoC / Exploit'ler şöyle: DirtyAH6 — CVE-2026-80844: https://github.com/manizada/DirtyAH6 TUNderflow — CVE-2026-81000: https://github.com/manizada/TUNderflow PPPoEject — CVE-2026-68121: https://github.com/manizada/PPPoEject DiagSpill — CVE-2026-74469: https://github.com/manizada/DiagSpill Şu ana kadar aktif saldırılarda kullanıldığına dair doğrulanmış bir bulgu bulunmuyor. Public exploit yayınlandığı için güncel kernel/security update'lerinin uygulanması mutlaka gerekli.

    Post summary

    A Turkish-language tweet announces publicly released PoC/exploit code for four critical Linux kernel local privilege escalation CVEs (2026-80844, 2026-81000, 2026-68121, 2026-74469) via four named GitHub repositories, with technical details including CVSS scores and affected subsystems, while explicitly confirming no active exploitation in the wild has been observed.

    040154910
    2.5K followersView on X
  • OS開発者@hacker_infra
    PoC

    いきなり4つのLPEのPoCが公開されている Red hatにメールで報告済み 緩和策 CVE-2026-80844 (DirtyAH6): The vulnerability requires the IPv6 AH6/XFRM path. On systems where IPv6 is not required, IPv6 can be disabled at boot: grubby --update-kernel=ALL --args="ipv6.disable=1" A reboot is required. CVE-2026-81000 (TUNderflow): On systems that do not require TUN/TAP, the tun kernel module can be disabled: echo "install tun /bin/true" > /etc/modprobe.d/disable-tun.conf CVE-2026-68121 (PPPoEject): On systems that do not require PPPoE, the pppoe kernel module can be disabled: echo "install pppoe /bin/true" > /etc/modprobe.d/disable-pppoe.conf CVE-2026-74469 (DiagSpill): On systems that do not require SCTP, the sctp kernel module can be disabled: echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf https://seclists.org/oss-sec/2026/q3/822

    Post summary

    The text announces the publication of four Linux Local Privilege Escalation (LPE) Proof-of-Concept exploits (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) and provides specific kernel module disablement workarounds as mitigations for each.

    04090471
    2.9K followersView on X
  • OS開発者@hacker_infra
    Patch

    9/18以降に追っているのは正確にはLPE 8件です。 CVE-2026-80844 CVE-2026-81000 CVE-2026-68121 CVE-2026-74469 CVE-2026-74753 CVE-2026-52910 CVE-2026-80521 CVE未採番：RustyTux / strparser・ESP-in-TCP race LPE 9/23まで、これ全部緩和策がわかるものとRed hatに報告した。異常すぎる密度だよ。

    Post summary

    The author reports tracking eight LPE vulnerabilities since September 18, including one unassigned CVE, and states they reported all to Red Hat with mitigations by September 23.

    00071562
    2.9K followersView on X
  • OS開発者@hacker_infra
    PoC

    red hatで正式に受理されてる。 緩和策は専用ページに合ったはず。 Hi OS開発者, Your request PSIRTSUPT-24215: Public LPE PoCs for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469 has been resolved. This request is now closed. If you have a new security concern or need further assistance, please reach out to us using one of the following options: • Initiate a new email thread to: secalert@redhat.com • Create a new request directly from the Jira portal: https://redhat.atlassian.net/servicedesk/customer/portal/68 Please note: Do not reply to this thread for new issues, as it has already been closed Thank you, Red Hat Product Security

    Post summary

    Red Hat Product Security closed a request (PSIRTSUPT-24215) concerning public Proof of Concept exploits for four Local Privilege Escalation CVEs, with a note that mitigations are available on a dedicated page.

    00021279
    2.9K followersView on X
  • Manuel Flores "Not giving away Crypto"@manuelfr51
    General

    @CloudLinuxOS What's the current CL8 kernel fix status for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469?

    Post summary

    The tweet inquires about the current kernel fix status for several CVEs from CloudLinuxOS, without providing any details on PoC, exploits, patches, or active exploitation.

    0000032
    461 followersView on X
  • BT Haberler@BTHaberler
    PoC

    Bir Araştırmacı, Yapay Zeka Yardımıyla Bulduğu Dört Linux Çekirdeği Açığı İçin Çalışan İstismar Kodunu Yayınladı! Güvenlik araştırmacısı Asim Manizada, yapay zeka destekli bir süreçle bulduğunu belirttiği dört Linux çekirdeği açığı için (DirtyAH6/CVE-2026-80844, TUNderflow/CVE-2026-81000, PPPoEject/CVE-2026-68121, DiagSpill/CVE-2026-74469) çalışan istismar kodunu kamuya yayınladı; hepsi çekirdeğin ağ kodunda bulunan bellek güvenliği açıkları ve yerel kullanıcılara root erişimi sağlıyor. • Açıklar sırasıyla IPv6 IPsec AH kodu, TUN/TAP sanal ağ cihazları, PPPoE kodu ve SCTP tanı kodunda bulunuyor; ilk tam düzeltmeler 5.10.270'ten 7.2.4'e kadar çeşitli çekirdek sürümlerinde mevcut. • Henüz gerçek saldırılarda kullanıldığına dair kanıt yok, ancak çalışan istismar kodunun kamuya açık hale gelmesi eski çekirdek çalıştıran sistemler için riski artırıyor. Tek bir araştırmacının yapay zeka yardımıyla aynı anda dört farklı çekirdek açığı bulup istismar kodu yazabilmesi, güvenlik açığı keşfinin hızının yapay zeka araçlarıyla ne kadar arttığını, savunma tarafının da aynı hızla yama uygulaması gerektiğini gösteriyor. #SiberGüvenlik #Linux #YapayZeka

    Post summary

    A security researcher published working exploit code for four Linux kernel vulnerabilities (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) using AI, with patches available in kernel 5.10.270 to 7.2.4. No active exploitation is reported, but the PoC release increases risk for older kernels.

    0000034
    44 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    PoC

    News: Asim Manizada published local-root PoCs for four Linux kernel bugs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Hits unpatched multi-user hosts. Patch to a fixed kernel (6.12.109+ or your distro advisory). https://www.infosectoday.io/public-exploits-released-for-four-linux-kernel-flaws-that-enable-local-root/

    Post summary

    Asim Manizada released proof‑of‑concept exploits for four Linux kernel local‑root vulnerabilities affecting unpatched multi‑user systems, and recommends patching to kernel 6.12.109+ or applying distro advisories.

    0000069
    3.0K followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Four Linux kernel bugs give local root: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Hits many kernels. Update to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4. https://www.openwall.com/lists/oss-security/2026/09/18/3

    Post summary

    The advisory discloses four Linux kernel local‑root vulnerabilities and directs users to apply specific patched kernel versions to mitigate them.

    0000066
    3.0K followersView on X

Explore more

Back to dashboard