Linux Kernel Receives Fixes for Four Local Root Flaws as Public Exploits Emerge

Manizada disclosed working PoCs on September 18 following a mid-July report to kernel security. Three flaws require unprivileged user namespaces, enabled by default in most distributions, to reach network privileges for escalation. DiagSpill bypasses this via SCTP. Fixes landed in stable kernels 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 and 7.2.4. No in-the-wild use is confirmed, though public code raises risk on shared servers and containers.

Technical evidence from Manizada's write-up shows DirtyAH6 and DiagSpill can trigger remote crashes under narrow IPv6 AH or non-default SCTP conditions, but remote root remains lab-only and difficult. This matches patterns in prior namespace-related LPEs such as CVE-2022-0847 Dirty Pipe and CVE-2016-5195 Dirty COW, where default isolation gaps repeatedly enable container escapes. Distribution advisories lag mainline, leaving older builds exposed.

Admins should verify distribution updates rather than kernel version numbers alone and disable unprivileged namespaces plus unused modules like SCTP where possible. Continued focus on namespace hardening and faster backports will be required as local kernel attack surface grows with container adoption.