Four Local-Root Linux Exploits Just Went Public: Why "Pending Reboot" Still Means "Vulnerable"

Proof-of-concept exploit code is now public for four Linux kernel vulnerabilities — DirtyAH6, TUNderflow, PPPoEject, and DiagSpill. Each one hands a local user a path to root on an unpatched system. Upstream fixes exist. No in-the-wild exploitation has been reported. And the detail every sysadmin should read twice: the PoCs can crash systems outright.

If you run a mixed estate — and almost every IT team does — this bulletin is a live stress test of your patch process. Not your patch intentions. Your process. Can you answer, in the next ten minutes, exactly which servers in your environment are running a vulnerable kernel? If the honest answer involves exporting a WSUS report, SSH-ing into boxes one at a time to run uname -r, and updating a spreadsheet, you are not doing patch management. You are doing patch archaeology.

The Problem in Depth

Local root changes the math

Local privilege escalation flaws never touch your perimeter. No exposed service, no VPN hole. Any user account is enough: a developer on a shared build server, a compromised web app shell, malware that arrived on a workstation via a phishing email. The moment exploit code executes, the attacker — or the malware — is root.

Because the published PoCs are unstable and can panic the kernel, you are carrying two risks at once: a security risk on unpatched systems, and an availability risk everywhere — one curious admin "just testing" the exploit on a shared staging box can take down services a dozen people depend on.

The kernel patch trap most reporting misses

Here is the part that burns teams every time a Linux kernel flaw goes public: installing the update fixes nothing until the machine reboots into the new kernel. A server can show "kernel update deployed" in every report you own while still running the vulnerable kernel from three months ago. The only state that matters is running the fixed kernel.

Windows has the same trap. A cumulative update installs, the device sits in "pending reboot" for two weeks, and that machine remains exploitable the entire time — while your patch dashboard counts it as compliant. If your tooling cannot distinguish installed from active, your compliance number is fiction.

Why your current stack cannot answer the question

• WSUS/SCCM gives you Windows-only snapshots. Machines that have not checked in for 30 days still show last month's status.
• Your RMM (ConnectWise Automate, NinjaOne, Datto RMM) covers managed endpoints — but servers where the agent was uninstalled, firewalled, or never deployed fall off the radar silently.
• Standalone monitoring (Nagios, Zabbix, PRTG) knows a box's uptime but has no idea what kernel or patch level it runs. It cannot tell a scheduled patch reboot from a crash.
• Your helpdesk sees none of it. Tickets arrive when users notice something is wrong — which is how you learn about outages at 8am instead of 2am.

None of these tools is broken on its own. The architecture is broken: patch state, monitoring state, and ticket state live in three systems that do not talk. So when a bulletin like this drops, answering "are we exposed?" means manually reconciling three sources of truth that disagree with each other.

What it actually costs

Walk through a realistic Monday. The bulletin hits at 9am. The Windows admin pulls a WSUS compliance report and spends two hours filtering out machines that have not reported. The Linux admin SSH-loops through 40 servers running uname -r and comparing versions against the distro advisory. By Wednesday, the "exposure spreadsheet" is mostly complete. Meanwhile, someone on the dev team runs the PPPoEject PoC on a shared box to see what happens. The kernel panics. Twelve people lose work. Twelve tickets arrive at the helpdesk saying "server down?" — and nobody connects them to the bulletin for hours, because the ticketing system and the patch effort live in different worlds.

Then there is the human cost: emergency after-hours patch windows, on-call techs blindsided by mystery reboots, SLA reports you cannot build because helpdesk data and monitoring data live in separate systems, and the MSP reality where one security question takes 20 minutes of manual work per client — a full week across 25 clients. That is how technicians burn out: not from hard problems, but from repetitive ones their tooling should have solved years ago.

How AlertMonitor Solves This

Real-time patch state, including the state that actually matters

AlertMonitor's patch management module tracks the patch status of every managed Windows device in real time: which machines are missing updates, which have failed patches, and which are pending a reboot. Not snapshots. Not last night's sync. When the next DirtyAH6-style bulletin drops, you filter for devices missing the relevant update and have your exposure list in seconds.

Critically, a device showing "pending reboot" is treated as what it is: still running the vulnerable code. Your compliance number finally matches reality.

Staged, scheduled, reversible deployments

Deploying a kernel-adjacent patch to 100% of the fleet at once is malpractice when public, system-crashing PoCs are part of the picture. AlertMonitor lets you schedule deployments, stage them by department or device group, and roll back if something breaks. Ring 0: test machines. Ring 1: IT staff. Ring 2: power users. Ring 3: everyone else. When something goes sideways, it goes sideways on a test ring — not on the CFO's laptop or the production file server.

Patch data plus monitoring data equals context

This is the integration that changes your nights. A device that reboots unexpectedly at 2am after an update fires an alert with full context: the patch job ran at 01:50, the reboot happened at 02:00, services are back — that is the patch doing its job, and the on-call tech goes back to sleep. The same reboot with no patch job attached is a genuine crash, and it pages someone immediately.

In the fragmented world, both reboots look identical in the monitoring tool, and both get discovered by end users at 8am. In AlertMonitor, the patch campaign, the reboot event, and the alert trail live in one timeline. Your 8am mystery becomes a 2am non-event.

The workflow, before and after

Before: bulletin → export WSUS report → reconcile stale machines → SSH loop over Linux boxes → manually deploy → hope → mystery reboots → tickets → spreadsheet for management.

After: bulletin → filter by missing patch in AlertMonitor → stage deployment rings → push → watch compliance climb live → reboots arrive with context, not tickets → one-click compliance report for management.

Days become hours, and the hours are mostly spent waiting on reboot windows, not reconciling spreadsheets. For the Linux servers in your estate, AlertMonitor's monitoring keeps continuous eyes on availability and services — so if a PoC panics a box at 2am, the alert reaches your phone, not an end user's patience at 8am.

Practical Steps: Do This Today

1. Sweep your Linux estate for running kernels. You cannot patch what you cannot enumerate:

for host in $(cat ~/linux_servers.txt); do
  printf "%-25s %s\n" "$host" "$(ssh -o ConnectTimeout=5 -o BatchMode=yes "$host" 'uname -r')"
done

Compare the output against your distro's security advisory for the fixed kernel versions covering DirtyAH6, TUNderflow, PPPoEject, and DiagSpill.

2. Find Linux boxes that installed a kernel but never rebooted — these are still vulnerable despite a "successful" update:

running=$(uname -r)
newest=$(ls /lib/modules | sort -V | tail -n 1)
if [ "$running" != "$newest" ]; then
  echo "PENDING REBOOT: running $running, installed $newest"
else
  echo "Kernel is current: $running"
fi

Or use the distro-native check:

# Debian/Ubuntu
[ -f /var/run/reboot-required ] && echo "Reboot required" || echo "No reboot pending"

# RHEL/Rocky/AlmaLinux
needs-restarting -r

3. Check which systems have kernel updates waiting to be installed:

# Debian/Ubuntu
sudo apt update && apt list --upgradable 2>/dev/null | grep linux-image

# RHEL/Rocky/AlmaLinux
sudo yum check-update kernel

4. Audit the Windows side of the estate — last installed hotfix and pending-reboot status across your servers:

$servers = Get-Content .\servers.txt
Invoke-Command -ComputerName $servers -ScriptBlock {
    $pendingReboot = Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending'
    $last = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
    [PSCustomObject]@{
        Server        = $env:COMPUTERNAME
        LastHotfix    = $last.HotFixID
        InstalledOn   = $last.InstalledOn
        PendingReboot = $pendingReboot
    }
} | Sort-Object PendingReboot -Descending | Format-Table -AutoSize

5. Then stop doing this by hand. In AlertMonitor: open Patch Management → review real-time compliance across the estate → create a deployment for the missing update → stage it by device group → schedule reboot windows that fit each ring → watch compliance climb live. The unexpected-reboot alerts tell you which reboots are yours and which are real incidents.

The specifics of these four flaws will be old news in a month — there is always a next bulletin. The teams that come through every one of them cleanly are not the ones with the best security reading habits. They are the ones who can answer "are we patched?" in minutes, with data they trust, and prove it.

Related Resources

AlertMonitor Patch Management & Software Updates AlertMonitor Platform Overview Book a Demo Patch Management & Software Updates Resources