Four Linux kernel LPE CVEs have working public exploits. DiagSpill needs no privileges.
On September 18, 2026, security researcher Asim Manizada published working exploit code for four local privilege escalation vulnerabilities in the Linux kernel. All four have been patched in distribution vendor updates, but public exploit code compresses the patch window to days. CISA added related Linux kernel LPE vulnerabilities to its Known Exploited Vulnerabilities catalog, with an FCEB deadline of October 8.
The four CVEs
DirtyAH6 (CVE-2026-80844) affects IPv6 Authentication Header processing in the Linux IPsec XFRM code. The kernel does not correctly validate the segments_left field in malformed IPv6 routing headers, leading to a memory corruption primitive. TUNderflow (CVE-2026-81000) is an integer underflow in virtual network device handling. PPPoEject (CVE-2026-68121) is a use-after-free in the PPP over Ethernet implementation where pppoe_sendmsg keeps a stale pointer after the socket buffer is reallocated. DiagSpill (CVE-2026-74469) is highest priority: the SCTP peer-transport counter overflows its 16-bit limit, causing insufficient Netlink response buffer allocation, and the kernel overwrites approximately 8 MB of heap space. DiagSpill requires no special privileges.
Why DiagSpill stands out
Most local privilege escalation vulnerabilities require some elevated capability or a specific process context. DiagSpill does not. Any unprivileged local user, or any process running inside a container with access to SCTP sockets, can trigger the overflow. In shared-hosting, multi-tenant, or CI/CD environments where code from multiple sources executes on the same host, the exploit is effectively available to any workload on the machine. Container breakout combined with LPE to host root is a well-understood attack chain; DiagSpill provides the LPE component with no privilege precondition.
What to do
Apply kernel updates from your Linux distribution vendor. All major distributions published patched kernels before the exploit code was released on September 18. Run uname -r and compare against the patched build number in your vendor advisory. For systems where kernel updates are operationally difficult, disabling SCTP where it is unused is a workaround for DiagSpill specifically. The exploit code is public, which means automated exploitation is now a realistic threat. FCEB agencies were given until October 8; treat that as the absolute maximum, not a target date.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want help prioritizing your kernel patch rollout or hardening your container environment.