Four newly disclosed Linux kernel vulnerabilities could enable local attackers to corrupt kernel memory and elevate privileges to root on affected systems. The flaws, named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, impact long-standing networking code and have now been patched. The issue arises when the kernel fails to properly validate the segments_left field when handling malformed IPv6 routing-header values.
However, systems acting as IPv6 routers or gateways that employ AH in transport mode could face a remote denial-of-service risk under specific conditions. The researcher demonstrated remote root access in a laboratory setting with memory grooming, though achieving that through a remote-only attack was described as highly challenging.
A malicious local user can exploit oversized receive-headroom values in specific network-device configurations, such as Open vSwitch paths, to cause an integer underflow during socket-buffer allocation. When the count reaches the limit, it wraps to zero, causing the diagnostic code to reserve insufficient space before copying peer information. Unlike the first three issues, DiagSpill does not necessitate unprivileged user namespaces or special Linux capabilities when SCTP and sctp_diag support are enabled.
The first stable releases addressing the complete set are Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. For organizations where immediate patching is not feasible, they should restrict unprivileged user namespaces and disable unused AH6, TUN/TAP, PPPoE, SCTP, or sctp_diag functionalities.
