Reported by 8 outlets

Timeline

1. original reporting

   Four Linux kernel privilege escalation flaws were disclosed with public PoC exploits granting local root. Details and patches are now out. U

   securityonline.info · 25d ago · September 18th, 2026

   Four Linux kernel privilege escalation flaws were disclosed with public PoC exploits granting local root. Details and patches are now out. U

   via Mastodon https://securityonline.info/linux-kernel-lpe-quartet-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

2. update from access.redhat.com

   CVE-2026-72018 Red Hat Security Advisory

   access.redhat.com · 60d ago · August 15th, 2026

   Red Hat published a CVE entry for CVE-2026-72018 on August 15, 2026, describing an out-of-bounds write in the Linux kernel dibs_loopback driver due to a missing bounds check in move_data(). The advisory notes the vulnerability allows memory corruption and potential privilege escalation, referencing the upstream kernel CVE announce from the same date. This predates the story's first_seen by over a month, confirming the SMC-D loopback flaw was already cataloged before the quartet disclosure.

3. update from www.valtersit.com

   CVE-2026-81000 Linux kernel tun driver integer underflow in tun_get_user() via oversized headroom from OVS, leading to memory corruption. No

   www.valtersit.com · 26d ago · September 17th, 2026

   CVE-2026-81000 Linux kernel tun driver integer underflow in tun_get_user() via oversized headroom from OVS, leading to memory corruption. No

   via Mastodon https://www.valtersit.com/cve/CVE-2026-81000/

4. update from heyitsas.im

   Four Linux kernel LPE flaws disclosed with PoC exploits: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469)

   heyitsas.im · 25d ago · September 18th, 2026

   Ouep, vendredi vuln assisté is back : le kernel Linux, toujours la cible préférée du branding CVE 🐧 DirtyAH6 (CVE-2026-80844), TUNderflow (C

   via Mastodon https://heyitsas.im/posts/lpe-quartet/

5. update from gbhackers.com

   Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell

   gbhackers.com · 25d ago · September 18th, 2026

   Linux administrators are being urged to patch four newly disclosed local privilege escalation (LPE) vulnerabilities, collectively known as DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. These vulnerabilities can allow attackers to corrupt kernel memory and gain root-level access on affected systems. The vulnerabilities are tracked under the following CVE identifiers: CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. They affect […] The post Linux Kernel Hit by 4 LPE Flaws Enabling Attackers to Gain Root Shell appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

6. update from thehackernews.com

   Four Linux kernel flaws now have public exploits, users could potentially escalate to root

   thehackernews.com · 24d ago · September 19th, 2026

   So an attacker would generally need some access to the system first, but could potentially use these flaws to gain root access . This matters especially for shared servers, cloud/hosting systems and machines running older kernels. Fixes are already available, so updating your kernel/distro packages is recommended. So far, there are no reports of these exploits being used in real-world attacks. Source: submitted by /u/thechougala [link] [comments]

   via reddit r/cybersecurity: Four Linux kernel flaws now have public exploits, users could potentially escalate to root

7. mentioned by heyitsas.im

   A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill: https:// heyitsas.im/posts/lpe-quartet/ # cybersecurity

   heyitsas.im · 24d ago · September 19th, 2026

8. update from cyberpress.org

   Linux Kernel Out-of-Bounds Write Flaw Enables Local Privilege Escalation to Root

   cyberpress.org · 13d ago · September 30th, 2026

   The flaw affects the DIBS loopback implementation used by the Shared Memory Communications Direct (SMC-D) subsystem and has received a CVSS 3.1 score of 7.8, rated High. Linux Kernel Out-of-Bounds Write Flaw The vulnerable function copies data to a Direct Memory Buffer (DMB) through memcpy() but does not validate whether the supplied offset plus write length remains within the allocated DMB boundary. Shared Memory Communications (Source: xbow) SMC is an IBM-designed protocol intended to reduce data-copy overhead for high-throughput connections. While SMC-R uses RDMA-capable hardware, SMC-D is designed for shared-memory communication. Historically, SMC-D was closely associated with IBM Z environments and specialized ISM hardware, limiting routine audit coverage. The introduction of the dibs_loopback virtual transport, however, made relevant SMC-D paths reachable on standard x86 Linux systems without dedicated hardware. XBOW researchers found that attacker-controlled fields in the SMC Connection Layer Control handshake could influence buffer offset calculations. In particular, the dmbe_idx and dmbe_size values can contribute to the transmit offset, while a DMB token selects the destination buffer.

9. update from gbhackers.com

   Linux Kernel CVE-2026-72018 Flaw Lets Local Attackers Gain Root Access

   gbhackers.com · 13d ago · September 30th, 2026

   A high-severity Linux kernel vulnerability, tracked as CVE-2026-72018, lets a local attacker with CAP_NET_ADMIN privileges escalate to root.

10. update from starlabs.sg

    AF_ALG Linux Local Privilege Escalation https:// starlabs.sg/blog/2026/09-h ow-i-found-a-113337-af_alg-linux-local-privilege-escalation-befo

    starlabs.sg · 12d ago · October 1st, 2026

    AF_ALG Linux Local Privilege Escalation https:// starlabs.sg/blog/2026/09-h ow-i-found-a-113337-af_alg-linux-local-privilege-escalation-befo

    via X https://starlabs.sg/blog/2026/09-how-i-found-a-113337-af_alg-linux-local-privilege-escalation-before-copy-fail/