A researcher has made public the exploit code for four vulnerabilities in the Linux kernel that allow local users to gain root access. While these flaws have been patched in the latest updates, systems with outdated kernels remain at risk. The vulnerabilities, named DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, were discovered by Asim Manizada and reported to the Linux kernel security team in July. Manizada released the exploits on September 18, following a period of coordination with Linux distributions to ensure patches were available. Currently, there are no reports of these vulnerabilities being exploited in real-world attacks, but the availability of public exploit code increases the risk for shared systems, especially those with unprivileged user namespaces enabled. Three of the flaws require these namespaces, which are often enabled by default, for an ordinary user to exploit them. However, DiagSpill can be exploited without any special privileges as long as the SCTP networking module is present. Two of the flaws, DirtyAH6 and DiagSpill, have network-based triggers, but these are limited and primarily result in system crashes. Manizada noted that while remote root access was achieved in a controlled lab setting with DirtyAH6, doing so remotely is highly challenging. The researcher emphasized the importance of updating to a patched kernel version, as the memory-safety bugs could lead to kernel memory corruption and root shell access. These flaws were identified using an AI-assisted method that maps how the kernel manages memory. This release is part of a trend of Linux kernel privilege escalation vulnerabilities being disclosed, with AI tools playing a significant role in their discovery.