{"vulnerability": "cve-2026-80844", "sightings": [{"uuid": "5c9c75bf-8115-4fdf-9a60-803943b0e369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117290704561368341", "content": "It's Friday, and we have 4 more local privilege escalation vulnerabilities disclosed for the Linux kernel:\n- DirtyAH6 (CVE-2026-80844)- TUNderflow (CVE-2026-81000)- PPPoEject (CVE-2026-68121)- DiagSpill (CVE-2026-74469)\n\"The underlying bugs have been around for 10-21 years. The first three LPEs require either unprivileged user namespaces or specific CAPs; DiagSpill does not.\"\nhttps://www.openwall.com/lists/oss-security/2026/09/18/3https://heyitsas.im/posts/lpe-quartet/\n#CVE_2026_80844 #CVE_2026_81000 #CVE_2026_68121 #CVE_2026_74469", "creation_timestamp": "2026-09-18T06:48:41.967653Z"}, {"uuid": "bc09eca5-9765-460a-b096-497a52743331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117291036654007377", "content": "Ouep, vendredi vuln assist\u00e9 is back : le kernel Linux, toujours la cible pr\u00e9f\u00e9r\u00e9e du branding CVE \ud83d\udc27 \nDirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) et DiagSpill (CVE-2026-74469) permettent, dans les configurations adapt\u00e9es, \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'obtenir root. Bugs pr\u00e9sents dans le kernel depuis 10 \u00e0 21 ans.\nRisque pas uniforme : les trois premi\u00e8res n\u00e9cessitent des user namespaces non privil\u00e9gi\u00e9s + des fonctionnalit\u00e9s r\u00e9seau particuli\u00e8res (AH6/XFRM, TUN/TAP, PPPoE). DiagSpill est directement accessible sans capability, MAIS n\u00e9cessite SCTP + sctp_diag.\nPas de RCE distante g\u00e9n\u00e9rique, mais nuance \u00e0 conna\u00eetre pour les passerelles : DirtyAH6 peut causer un DoS distant sur un routeur IPv6 faisant de l'AH en mode transport (root distant obtenu en labo par l'auteur, via grooming c\u00f4t\u00e9 cible--> jug\u00e9 \"extr\u00eamement difficile\"). DiagSpill a aussi un vecteur DoS distant si ASCONF/ADD-IP + SCTP-AUTH (ou addip_noauth_enable=1) sont actifs-->d\u00e9sactiv\u00e9s par d\u00e9faut.\n\u27a1\ufe0f \u00c0 surveiller en priorit\u00e9 : syst\u00e8mes multi-utilisateurs, conteneurs, h\u00f4tes TUN/TAP, PPPoE, XFRM/AH6 ou SCTP.\n\ud83d\udd0e Analyse compl\u00e8te\ud83d\udc47  https://heyitsas.im/posts/lpe-quartet/\n:debian: \ud83d\udc47 DirtyAH6 corrig\u00e9 sur Bookworm-security, encore vuln\u00e9rable sur Trixie.\nTUNderflow corrig\u00e9e uniquement dans sid \nPPPoEject et DiagSpill corrig\u00e9s sur Bookworm-security et Trixie.\u2b07\ufe0f \n\n\nDirtyAH6 \u2014 CVE-2026-80844Debian Security Tracker\n\nTUNderflow \u2014 CVE-2026-81000Debian Security Tracker\n\nPPPoEject \u2014 CVE-2026-68121Debian Security Tracker\n\nDiagSpill \u2014 CVE-2026-74469Debian Security Tracker\nPoCs \ud83d\udc40 \ud83d\udc47DirtyAH6 \u2014 CVE-2026-80844 : https://github.com/manizada/DirtyAH6TUNderflow \u2014 CVE-2026-81000 : https://github.com/manizada/TUNderflowPPPoEject \u2014 CVE-2026-68121 : https://github.com/manizada/PPPoEjectDiagSpill \u2014 CVE-2026-74469 : https://github.com/manizada/DiagSpill\n#Linux #CyberSecurity #Vulnerability #CVE #Debian", "creation_timestamp": "2026-09-18T08:13:07.935680Z"}, {"uuid": "cbeeb0da-8095-43ef-8941-95ef5ba65005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3630", "content": "LPE quartet of Linux local root\n*\nDirtyAH6   CVE-2026-80844  POC\nTUNderflow   CVE-2026-81000 POC\nPPPoEject   CVE-2026-68121 POC\nDiagSpill   CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-19T10:00:04.553980Z"}, {"uuid": "e925c875-8b26-44e9-a5f8-659145d35663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/49238", "content": "LPE quartet of Linux local root\n*\nDirtyAH6   CVE-2026-80844  POC\nTUNderflow   CVE-2026-81000 POC\nPPPoEject   CVE-2026-68121 POC\nDiagSpill   CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-19T10:00:04.341117Z"}, {"uuid": "3db487ae-d43b-4a36-a616-03172b41f265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mvuvh3xykh23", "content": "CVE-2026-80844 is trending. Hype score 9, currently #5 on cvemon.\n\nIn the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-80844", "creation_timestamp": "2026-09-19T14:30:01.468772Z"}, {"uuid": "c1a41fb3-cc7f-42fa-9e7f-706beeb73968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3630", "content": "LPE quartet of Linux local root\n*\nDirtyAH6   CVE-2026-80844  POC\nTUNderflow   CVE-2026-81000 POC\nPPPoEject   CVE-2026-68121 POC\nDiagSpill   CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-20T00:00:11.251810Z"}, {"uuid": "d791b41e-d47c-410d-a996-3e5a5b717f3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/49238", "content": "LPE quartet of Linux local root\n*\nDirtyAH6   CVE-2026-80844  POC\nTUNderflow   CVE-2026-81000 POC\nPPPoEject   CVE-2026-68121 POC\nDiagSpill   CVE-2026-74469 POC\n\n+ WriteUP \u0438\u0437 2178 \u0441\u043b\u043e\u0432\n\n#linux #LPE", "creation_timestamp": "2026-09-20T00:00:10.934869Z"}, {"uuid": "3dd49eeb-fa40-46e5-9026-62764ba833d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mw2lz5ita22g", "content": "Monday's redteam tool collection: LPE quartet of Linux local root:\nDirtyAH6   CVE-2026-80844 github.com/manizada/Dir...\nTUNderflow   CVE-2026-81000 github.com/manizada/TUN...\nPPPoEject   CVE-2026-68121 github.com/manizada/PPP... \nDiagSpill   CVE-2026-74469 github.com/manizada/Dia... #redteam #LPE", "creation_timestamp": "2026-09-21T10:57:24.273440Z"}, {"uuid": "a0113ff0-4d93-44e4-b1bd-8ca6cca30b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "published-proof-of-concept", "source": "Telegram/JCHQ1FmDZZqlidw9P5UL7Y-oym8Z3sAmGgcN9iHR-Aih1-w", "content": "", "creation_timestamp": "2026-09-22T07:00:03.588475Z"}, {"uuid": "4db2b42a-0fd7-4bfa-9f99-5e90d490a164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "Telegram/6b-rkbWXWakDcg0xMKZrOjk11Dq6lI735beDpEcqG6K42dE", "content": "", "creation_timestamp": "2026-09-22T07:00:10.679708Z"}, {"uuid": "28901f4d-daab-47d2-912b-f5bf4142660f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "Telegram/Bq15RX4hLps3YxF9UScb9X_cGJp6cilOG7wedbwLQyx-TtQ", "content": "", "creation_timestamp": "2026-09-22T07:00:09.720396Z"}, {"uuid": "6133f830-28ed-4be2-8b1e-65127a0b1767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://t.me/linuxtnt/5275", "content": "\ud83d\udd30 \u0627\u0645\u0646\u06cc\u062a \u0644\u06cc\u0646\u0648\u06a9\u0633 | \u0645\u0648\u062c \u062c\u062f\u06cc\u062f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc Kernel\n\u062f\u0631 \u0631\u0648\u0632\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631 \u0686\u0646\u062f \u062e\u0628\u0631 \u0645\u0647\u0645 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062f\u0631\u0628\u0627\u0631\u0647 Linux Kernel \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u06a9\u0647 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u0647\u0645 \u0627\u0646\u062a\u0634\u0627\u0631 Exploit\u0647\u0627\u06cc \u0639\u0645\u0648\u0645\u06cc \u0648 \u0647\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 AI \u0628\u0631\u0627\u06cc \u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u062f\u0631 \u062d\u0627\u0644 \u0627\u0641\u0632\u0627\u06cc\u0634 \u0627\u0633\u062a.\n\n\ud83d\udd39 \u06f4 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0627\u0645\u06a9\u0627\u0646 Local Root\n\u0628\u0631\u0627\u06cc \u0686\u0647\u0627\u0631 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u06a9\u0631\u0646\u0644\u060c \u06a9\u062f\u0647\u0627\u06cc Exploit \u0639\u0645\u0648\u0645\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0634\u0631\u0627\u06cc\u0637 \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u06cc\u06a9 \u06a9\u0627\u0631\u0628\u0631 \u0645\u062d\u0644\u06cc \u0628\u062f\u0648\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0627\u0644\u0627 \u0627\u0645\u06a9\u0627\u0646 \u0631\u0633\u06cc\u062f\u0646 \u0628\u0647 Root \u0631\u0627 \u0628\u062f\u0647\u0646\u062f:\n\u2022 CVE-2026-80844 \u2014 DirtyAH6\n\u2022 CVE-2026-81000 \u2014 TUNderflow\n\u2022 CVE-2026-68121 \u2014 PPPoEject\n\u2022 CVE-2026-74469 \u2014 DiagSpill\n\n\u0627\u06cc\u0646 \u0686\u0647\u0627\u0631 \u0646\u0642\u0635 \u062f\u0631 \u0628\u062e\u0634\u200c\u0647\u0627\u06cc \u0645\u062e\u062a\u0644\u0641 Networking Kernel \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f. Patch\u0647\u0627\u06cc \u0622\u0646\u200c\u0647\u0627 \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647\u060c \u0627\u0645\u0627 \u0627\u0646\u062a\u0634\u0627\u0631 \u0639\u0645\u0648\u0645\u06cc Exploit \u0627\u0647\u0645\u06cc\u062a \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc Kernel \u0631\u0627 \u0628\u06cc\u0634\u062a\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\u26a0\ufe0f \u0646\u06a9\u062a\u0647: \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627 \u0639\u0645\u062f\u062a\u0627\u064b Local Privilege Escalation \u0647\u0633\u062a\u0646\u062f\u061b \u06cc\u0639\u0646\u06cc \u0645\u0647\u0627\u062c\u0645 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0627\u0628\u062a\u062f\u0627 \u0628\u0627\u06cc\u062f \u0646\u0648\u0639\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u062d\u0644\u06cc \u06cc\u0627 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0628\u0627 \u0633\u0637\u062d \u067e\u0627\u06cc\u06cc\u0646 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.\n  \n\ud83d\udd39\u0627\u0645\u0627  AI \u062f\u0631 \u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\n\u0645\u0648\u0636\u0648\u0639 \u062c\u0627\u0644\u0628\u200c\u062a\u0631\u060c \u0646\u0642\u0634 AI \u062f\u0631 \u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u0628\u0627\u06af\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc Kernel \u0627\u0633\u062a.\n\u062f\u0631 \u0645\u0627\u0647 \u0645\u0647\u060c \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc CVE-2026-31431 \u0628\u0627 \u0646\u0627\u0645 Copy Fail \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u061b \u0628\u0627\u06af\u06cc \u06a9\u0647 \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f7 \u062f\u0631 Linux Kernel \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a \u0648 \u0628\u0627 \u06a9\u0645\u06a9 \u0627\u0628\u0632\u0627\u0631 Xint Code \u0627\u0632 \u067e\u0644\u062a\u0641\u0631\u0645 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 AI \u0634\u0631\u06a9\u062a Theori \u06a9\u0634\u0641 \u0634\u062f.\n\ud83d\udd0e \u06cc\u06a9 \u0646\u0645\u0648\u0646\u0647 \u062f\u06cc\u06af\u0631\u060c CVE-2026-46333 \u0627\u0633\u062a \u06a9\u0647 \u0637\u0628\u0642 \u06af\u0632\u0627\u0631\u0634 Qualys \u0627\u0632 \u0633\u0627\u0644 \u06f2\u06f0\u06f1\u06f6 \u062f\u0631 \u06a9\u062f \u0627\u0635\u0644\u06cc Linux \u0648\u062c\u0648\u062f \u062f\u0627\u0634\u062a \u0648 \u06cc\u06a9 \u06a9\u0627\u0631\u0628\u0631 \u0645\u062d\u0644\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0633\u062a \u062f\u0631 \u0634\u0631\u0627\u06cc\u0637 \u0645\u0634\u062e\u0635 \u0627\u0632 \u0622\u0646 \u0628\u0631\u0627\u06cc \u0627\u0641\u0634\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0648 \u0627\u062c\u0631\u0627\u06cc \u0641\u0631\u0645\u0627\u0646 \u0628\u0627 \u0633\u0637\u062d Root \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u062f.\n \n\n \ud83d\udd39 \u0627\u062e\u0628\u0627\u0631 \u0648 \u0622\u0645\u0648\u0632\u0634 \u0628\u06cc\u0634\u062a\u0631 \u062f\u0631:\nhttps://learninghive.ir\n\ud83d\udd39\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/linuxtnt\n\ud83d\udd39 \u06a9\u0627\u0646\u0627\u0644 \u062f\u0631 \u0627\u067e\u0644\u06cc\u06a9\u0634\u0646 \u0628\u0644\u0647:\nhttp://ble.ir/linuxtnt", "creation_timestamp": "2026-09-22T10:00:05.092721Z"}]}