https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 18 Sep 2026 18:57:16 +0000 https://vulnerability.circl.lu/sighting/bc09eca5-9765-460a-b096-497a52743331/export {"uuid": "bc09eca5-9765-460a-b096-497a52743331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117291036654007377", "content": "Ouep, vendredi vuln assist\u00e9 is back : le kernel Linux, toujours la cible pr\u00e9f\u00e9r\u00e9e du branding CVE \ud83d\udc27 \nDirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) et DiagSpill (CVE-2026-74469) permettent, dans les configurations adapt\u00e9es, \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'obtenir root. Bugs pr\u00e9sents dans le kernel depuis 10 \u00e0 21 ans.\nRisque pas uniforme : les trois premi\u00e8res n\u00e9cessitent des user namespaces non privil\u00e9gi\u00e9s + des fonctionnalit\u00e9s r\u00e9seau particuli\u00e8res (AH6/XFRM, TUN/TAP, PPPoE). DiagSpill est directement accessible sans capability, MAIS n\u00e9cessite SCTP + sctp_diag.\nPas de RCE distante g\u00e9n\u00e9rique, mais nuance \u00e0 conna\u00eetre pour les passerelles : DirtyAH6 peut causer un DoS distant sur un routeur IPv6 faisant de l'AH en mode transport (root distant obtenu en labo par l'auteur, via grooming c\u00f4t\u00e9 cible--> jug\u00e9 \"extr\u00eamement difficile\"). DiagSpill a aussi un vecteur DoS distant si ASCONF/ADD-IP + SCTP-AUTH (ou addip_noauth_enable=1) sont actifs-->d\u00e9sactiv\u00e9s par d\u00e9faut.\n\u27a1\ufe0f \u00c0 surveiller en priorit\u00e9 : syst\u00e8mes multi-utilisateurs, conteneurs, h\u00f4tes TUN/TAP, PPPoE, XFRM/AH6 ou SCTP.\n\ud83d\udd0e Analyse compl\u00e8te\ud83d\udc47 https://heyitsas.im/posts/lpe-quartet/\n:debian: \ud83d\udc47 DirtyAH6 corrig\u00e9 sur Bookworm-security, encore vuln\u00e9rable sur Trixie.\nTUNderflow corrig\u00e9e uniquement dans sid \nPPPoEject et DiagSpill corrig\u00e9s sur Bookworm-security et Trixie.\u2b07\ufe0f \n\n\nDirtyAH6 \u2014 CVE-2026-80844Debian Security Tracker\n\nTUNderflow \u2014 CVE-2026-81000Debian Security Tracker\n\nPPPoEject \u2014 CVE-2026-68121Debian Security Tracker\n\nDiagSpill \u2014 CVE-2026-74469Debian Security Tracker\nPoCs \ud83d\udc40 \ud83d\udc47DirtyAH6 \u2014 CVE-2026-80844 : https://github.com/manizada/DirtyAH6TUNderflow \u2014 CVE-2026-81000 : https://github.com/manizada/TUNderflowPPPoEject \u2014 CVE-2026-68121 : https://github.com/manizada/PPPoEjectDiagSpill \u2014 CVE-2026-74469 : https://github.com/manizada/DiagSpill\n#Linux #CyberSecurity #Vulnerability #CVE #Debian", "creation_timestamp": "2026-09-18T08:13:07.935680Z"} {"uuid": "bc09eca5-9765-460a-b096-497a52743331", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/decio/statuses/117291036654007377", "content": "Ouep, vendredi vuln assist\u00e9 is back : le kernel Linux, toujours la cible pr\u00e9f\u00e9r\u00e9e du branding CVE \ud83d\udc27 \nDirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) et DiagSpill (CVE-2026-74469) permettent, dans les configurations adapt\u00e9es, \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'obtenir root. Bugs pr\u00e9sents dans le kernel depuis 10 \u00e0 21 ans.\nRisque pas uniforme : les trois premi\u00e8res n\u00e9cessitent des user namespaces non privil\u00e9gi\u00e9s + des fonctionnalit\u00e9s r\u00e9seau particuli\u00e8res (AH6/XFRM, TUN/TAP, PPPoE). DiagSpill est directement accessible sans capability, MAIS n\u00e9cessite SCTP + sctp_diag.\nPas de RCE distante g\u00e9n\u00e9rique, mais nuance \u00e0 conna\u00eetre pour les passerelles : DirtyAH6 peut causer un DoS distant sur un routeur IPv6 faisant de l'AH en mode transport (root distant obtenu en labo par l'auteur, via grooming c\u00f4t\u00e9 cible--> jug\u00e9 \"extr\u00eamement difficile\"). DiagSpill a aussi un vecteur DoS distant si ASCONF/ADD-IP + SCTP-AUTH (ou addip_noauth_enable=1) sont actifs-->d\u00e9sactiv\u00e9s par d\u00e9faut.\n\u27a1\ufe0f \u00c0 surveiller en priorit\u00e9 : syst\u00e8mes multi-utilisateurs, conteneurs, h\u00f4tes TUN/TAP, PPPoE, XFRM/AH6 ou SCTP.\n\ud83d\udd0e Analyse compl\u00e8te\ud83d\udc47 https://heyitsas.im/posts/lpe-quartet/\n:debian: \ud83d\udc47 DirtyAH6 corrig\u00e9 sur Bookworm-security, encore vuln\u00e9rable sur Trixie.\nTUNderflow corrig\u00e9e uniquement dans sid \nPPPoEject et DiagSpill corrig\u00e9s sur Bookworm-security et Trixie.\u2b07\ufe0f \n\n\nDirtyAH6 \u2014 CVE-2026-80844Debian Security Tracker\n\nTUNderflow \u2014 CVE-2026-81000Debian Security Tracker\n\nPPPoEject \u2014 CVE-2026-68121Debian Security Tracker\n\nDiagSpill \u2014 CVE-2026-74469Debian Security Tracker\nPoCs \ud83d\udc40 \ud83d\udc47DirtyAH6 \u2014 CVE-2026-80844 : https://github.com/manizada/DirtyAH6TUNderflow \u2014 CVE-2026-81000 : https://github.com/manizada/TUNderflowPPPoEject \u2014 CVE-2026-68121 : https://github.com/manizada/PPPoEjectDiagSpill \u2014 CVE-2026-74469 : https://github.com/manizada/DiagSpill\n#Linux #CyberSecurity #Vulnerability #CVE #Debian", "creation_timestamp": "2026-09-18T08:13:07.935680Z"} https://vulnerability.circl.lu/sighting/bc09eca5-9765-460a-b096-497a52743331/export Fri, 18 Sep 2026 08:13:07 +0000 https://vulnerability.circl.lu/sighting/5c9c75bf-8115-4fdf-9a60-803943b0e369/export {"uuid": "5c9c75bf-8115-4fdf-9a60-803943b0e369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117290704561368341", "content": "It's Friday, and we have 4 more local privilege escalation vulnerabilities disclosed for the Linux kernel:\n- DirtyAH6 (CVE-2026-80844)- TUNderflow (CVE-2026-81000)- PPPoEject (CVE-2026-68121)- DiagSpill (CVE-2026-74469)\n\"The underlying bugs have been around for 10-21 years. The first three LPEs require either unprivileged user namespaces or specific CAPs; DiagSpill does not.\"\nhttps://www.openwall.com/lists/oss-security/2026/09/18/3https://heyitsas.im/posts/lpe-quartet/\n#CVE_2026_80844 #CVE_2026_81000 #CVE_2026_68121 #CVE_2026_74469", "creation_timestamp": "2026-09-18T06:48:41.967653Z"} {"uuid": "5c9c75bf-8115-4fdf-9a60-803943b0e369", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80844", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/117290704561368341", "content": "It's Friday, and we have 4 more local privilege escalation vulnerabilities disclosed for the Linux kernel:\n- DirtyAH6 (CVE-2026-80844)- TUNderflow (CVE-2026-81000)- PPPoEject (CVE-2026-68121)- DiagSpill (CVE-2026-74469)\n\"The underlying bugs have been around for 10-21 years. The first three LPEs require either unprivileged user namespaces or specific CAPs; DiagSpill does not.\"\nhttps://www.openwall.com/lists/oss-security/2026/09/18/3https://heyitsas.im/posts/lpe-quartet/\n#CVE_2026_80844 #CVE_2026_81000 #CVE_2026_68121 #CVE_2026_74469", "creation_timestamp": "2026-09-18T06:48:41.967653Z"} https://vulnerability.circl.lu/sighting/5c9c75bf-8115-4fdf-9a60-803943b0e369/export Fri, 18 Sep 2026 06:48:41 +0000