DirtyAH6 and three other kernel bugs: install RHSB-2026-011
On 19 September 2026 Red Hat published four local privilege-escalation bugs in the kernel network stack. They are not the October Fragnesia issue. They still need a reboot.
Red Hat's bulletin RHSB-2026-011, public on 19 September 2026 and updated on 26 September, names four flaws: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject) and CVE-2026-74469 (DiagSpill). Each sits in a different part of the network stack. All four can lead to root when their conditions are met.
This is a separate queue item from CVE-2026-46300 (Fragnesia), which CISA listed in late October. A host patched for one is not patched for the other.
What Red Hat said changed
DirtyAH6, TUNderflow and PPPoEject are reached by a local user who can create a user namespace and a network namespace, or by a process that already holds the network capabilities inside a namespace it controls. DiagSpill does not need a new user namespace. Red Hat also says DiagSpill can be a remote denial of service in specific SCTP setups when a local process asks for diagnostics.
The bulletin rates the set Important. It does not describe a drive-by against a web server. It describes a logged-in user, or a container, becoming root. On a multi-tenant build host that is the whole incident.
Where a local kernel bug is the incident
CI runners, shared notebooks, and Kubernetes nodes that allow unprivileged user namespaces are the ordinary path Red Hat names. A container escape that ends in one of these bugs is no longer contained. The neighbor on the node is the next step, not a different ticket.
DiagSpill's denial-of-service note matters on hosts that speak SCTP and expose it. If you do not run SCTP, that clause is not your outage. The local escalation clauses still are.
What 'fixed' means in this bulletin
Red Hat said on 26 September 2026 that fixes were out for many product streams and still being expedited for the rest. The action is the errata for the product you pay for, not a kernel you compiled from a mailing list because the nickname sounded urgent.
Other distributions shipped equivalent updates on their own calendars. Match the CVE numbers — CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469 — against your vendor's advisory. A generic 'kernel updated in September' line in a ticket does not prove these four are in it.
Update, reboot, and narrow namespaces
Install the vendor kernel that lists these CVEs and reboot. Check the running version afterwards. On hosts that do not need unprivileged user namespaces, turn that feature off if your platform documents it as the mitigation that blocks the ordinary path for DirtyAH6, TUNderflow and PPPoEject. Red Hat is explicit that a process which already has the capabilities can still reach those three.
Do not treat a container runtime update as a substitute. The bug is in the kernel those containers share. This article does not include a way to trigger the flaws.
Red Hat bulletin RHSB-2026-011, public 19 September 2026 and updated 26 September 2026.
https://access.redhat.com/security/vulnerabilities/RHSB-2026-011
Frequently asked questions
Is DirtyAH6 the same bug as Fragnesia?
No. DirtyAH6 is CVE-2026-80844, in Red Hat's September bulletin RHSB-2026-011. Fragnesia is CVE-2026-46300, listed by CISA on 28 October 2026. Patch both.
Can a remote visitor hit DirtyAH6 directly?
Red Hat describes a local user or a process with network capabilities in a namespace. DiagSpill adds a denial-of-service case on specific SCTP configurations. This is not an unauthenticated remote code execution in the web server.
Does the package install finish the change?
The new kernel has to be the one that boots. Confirm the running build after the reboot, and confirm the advisory names all four CVEs.