A quartet of Linux local-root vulnerabilities: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
A coordinated disclosure describes four long-lived Linux kernel bugs that yield unprivileged local-to-root execution on affected configurations. The bugs span IPv6 AH routing-header validation, TUN receive-headroom arithmetic, a stale sk_buff pointer in PPPoE, and an SCTP transport-count overflow; the first three commonly need user namespaces or capabilities, while DiagSpill does not. Fixes are landing in stable kernels, and the disclosure includes mitigations such as disabling unused AH6, TUN, PPPoE, or SCTP paths.