https://vulnerability.circl.lu/sightings/feed 2026-09-21T19:56:20.422347+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3dd49eeb-fa40-46e5-9026-62764ba833d0/export 2026-09-21T19:56:20.448085+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3dd49eeb-fa40-46e5-9026-62764ba833d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mw2lz5ita22g", "content": "Monday's redteam tool collection: LPE quartet of Linux local root:\nDirtyAH6 CVE-2026-80844 github.com/manizada/Dir...\nTUNderflow CVE-2026-81000 github.com/manizada/TUN...\nPPPoEject CVE-2026-68121 github.com/manizada/PPP... \nDiagSpill CVE-2026-74469 github.com/manizada/Dia... #redteam #LPE", "creation_timestamp": "2026-09-21T10:57:24.273440Z"} 2026-09-21T10:57:24.273440+00:00 https://vulnerability.circl.lu/sighting/c1a41fb3-cc7f-42fa-9e7f-706beeb73968/export 2026-09-21T19:56:20.451511+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c1a41fb3-cc7f-42fa-9e7f-706beeb73968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3630", "content": "LPE quartet of Linux local root\n*\nDirtyAH6 CVE-2026-80844 POC\nTUNderflow CVE-2026-81000 POC\nPPPoEject CVE-2026-68121 POC\nDiagSpill CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-20T00:00:11.251810Z"} 2026-09-20T00:00:11.251810+00:00 https://vulnerability.circl.lu/sighting/d791b41e-d47c-410d-a996-3e5a5b717f3b/export 2026-09-21T19:56:20.451821+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "d791b41e-d47c-410d-a996-3e5a5b717f3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/49238", "content": "LPE quartet of Linux local root\n*\nDirtyAH6 CVE-2026-80844 POC\nTUNderflow CVE-2026-81000 POC\nPPPoEject CVE-2026-68121 POC\nDiagSpill CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-20T00:00:10.934869Z"} 2026-09-20T00:00:10.934869+00:00 https://vulnerability.circl.lu/sighting/3db487ae-d43b-4a36-a616-03172b41f265/export 2026-09-21T19:56:20.451923+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3db487ae-d43b-4a36-a616-03172b41f265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mvuvh3xykh23", "content": "CVE-2026-80844 is trending. Hype score 9, currently #5 on cvemon.\n\nIn the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-80844", "creation_timestamp": "2026-09-19T14:30:01.468772Z"} 2026-09-19T14:30:01.468772+00:00 https://vulnerability.circl.lu/sighting/cbeeb0da-8095-43ef-8941-95ef5ba65005/export 2026-09-21T19:56:20.451997+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "cbeeb0da-8095-43ef-8941-95ef5ba65005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3630", "content": "LPE quartet of Linux local root\n*\nDirtyAH6 CVE-2026-80844 POC\nTUNderflow CVE-2026-81000 POC\nPPPoEject CVE-2026-68121 POC\nDiagSpill CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-19T10:00:04.553980Z"} 2026-09-19T10:00:04.553980+00:00 https://vulnerability.circl.lu/sighting/e925c875-8b26-44e9-a5f8-659145d35663/export 2026-09-21T19:56:20.452068+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e925c875-8b26-44e9-a5f8-659145d35663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/49238", "content": "LPE quartet of Linux local root\n*\nDirtyAH6 CVE-2026-80844 POC\nTUNderflow CVE-2026-81000 POC\nPPPoEject CVE-2026-68121 POC\nDiagSpill CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-19T10:00:04.341117Z"} 2026-09-19T10:00:04.341117+00:00 https://vulnerability.circl.lu/sighting/bc09eca5-9765-460a-b096-497a52743331/export 2026-09-21T19:56:20.452141+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bc09eca5-9765-460a-b096-497a52743331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117291036654007377", "content": "Ouep, vendredi vuln assist\u00e9 is back : le kernel Linux, toujours la cible pr\u00e9f\u00e9r\u00e9e du branding CVE \ud83d\udc27 \nDirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) et DiagSpill (CVE-2026-74469) permettent, dans les configurations adapt\u00e9es, \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'obtenir root. Bugs pr\u00e9sents dans le kernel depuis 10 \u00e0 21 ans.\nRisque pas uniforme : les trois premi\u00e8res n\u00e9cessitent des user namespaces non privil\u00e9gi\u00e9s + des fonctionnalit\u00e9s r\u00e9seau particuli\u00e8res (AH6/XFRM, TUN/TAP, PPPoE). DiagSpill est directement accessible sans capability, MAIS n\u00e9cessite SCTP + sctp_diag.\nPas de RCE distante g\u00e9n\u00e9rique, mais nuance \u00e0 conna\u00eetre pour les passerelles : DirtyAH6 peut causer un DoS distant sur un routeur IPv6 faisant de l'AH en mode transport (root distant obtenu en labo par l'auteur, via grooming c\u00f4t\u00e9 cible--> jug\u00e9 \"extr\u00eamement difficile\"). DiagSpill a aussi un vecteur DoS distant si ASCONF/ADD-IP + SCTP-AUTH (ou addip_noauth_enable=1) sont actifs-->d\u00e9sactiv\u00e9s par d\u00e9faut.\n\u27a1\ufe0f \u00c0 surveiller en priorit\u00e9 : syst\u00e8mes multi-utilisateurs, conteneurs, h\u00f4tes TUN/TAP, PPPoE, XFRM/AH6 ou SCTP.\n\ud83d\udd0e Analyse compl\u00e8te\ud83d\udc47 https://heyitsas.im/posts/lpe-quartet/\n:debian: \ud83d\udc47 DirtyAH6 corrig\u00e9 sur Bookworm-security, encore vuln\u00e9rable sur Trixie.\nTUNderflow corrig\u00e9e uniquement dans sid \nPPPoEject et DiagSpill corrig\u00e9s sur Bookworm-security et Trixie.\u2b07\ufe0f \n\n\nDirtyAH6 \u2014 CVE-2026-80844Debian Security Tracker\n\nTUNderflow \u2014 CVE-2026-81000Debian Security Tracker\n\nPPPoEject \u2014 CVE-2026-68121Debian Security Tracker\n\nDiagSpill \u2014 CVE-2026-74469Debian Security Tracker\nPoCs \ud83d\udc40 \ud83d\udc47DirtyAH6 \u2014 CVE-2026-80844 : https://github.com/manizada/DirtyAH6TUNderflow \u2014 CVE-2026-81000 : https://github.com/manizada/TUNderflowPPPoEject \u2014 CVE-2026-68121 : https://github.com/manizada/PPPoEjectDiagSpill \u2014 CVE-2026-74469 : https://github.com/manizada/DiagSpill\n#Linux #CyberSecurity #Vulnerability #CVE #Debian", "creation_timestamp": "2026-09-18T08:13:07.935680Z"} 2026-09-18T08:13:07.935680+00:00 https://vulnerability.circl.lu/sighting/5c9c75bf-8115-4fdf-9a60-803943b0e369/export 2026-09-21T19:56:20.452223+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5c9c75bf-8115-4fdf-9a60-803943b0e369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117290704561368341", "content": "It's Friday, and we have 4 more local privilege escalation vulnerabilities disclosed for the Linux kernel:\n- DirtyAH6 (CVE-2026-80844)- TUNderflow (CVE-2026-81000)- PPPoEject (CVE-2026-68121)- DiagSpill (CVE-2026-74469)\n\"The underlying bugs have been around for 10-21 years. The first three LPEs require either unprivileged user namespaces or specific CAPs; DiagSpill does not.\"\nhttps://www.openwall.com/lists/oss-security/2026/09/18/3https://heyitsas.im/posts/lpe-quartet/\n#CVE_2026_80844 #CVE_2026_81000 #CVE_2026_68121 #CVE_2026_74469", "creation_timestamp": "2026-09-18T06:48:41.967653Z"} 2026-09-18T06:48:41.967653+00:00