CVE-2026-80521
CVSS 7.8 HIGH: in the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge().… Microsoft patch: Release Notes.
Vulnerabilities & Exploits · Zero-Day Exploit
DepthFirst published exploit code on September 22 for CVE-2026-80521, an AF_UNIX use-after-free in the Linux kernel that can turn a container-local socket path into host root. The upstream fix landed on August 6, but Ubuntu still had not shipped it for 26.04, 24.04, or 22.04, including cloud kernel builds for AWS, Azure, and GCP.
The bug sits in the kernel’s AF_UNIX garbage collector, which cleans up Unix-domain socket messages passed between processes. In the bad race, the collector can free part of a socket chain before it has removed every pointer to it, so a later pass follows a stale pointer into freed memory. Because containers are allowed to use these socket calls, the usual namespace and seccomp boundaries do not stop the escape.
For operators running shared-kernel Docker or Kubernetes fleets, the exposure is the host kernel itself: one compromised container can become host root and then touch co-resident workloads. The reporting leaves only the rollout gap as the practical question, because the upstream repair already exists while Ubuntu’s packages remain in transit.
1 source · 1 day ago
CVSS 7.8 HIGH: in the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge().… Microsoft patch: Release Notes.
The Hacker News
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape
A Linux AF_UNIX use-after-free can escape containers for host root; exploit code targets Ubuntu 26.04, which remains unpatched.
originalPart of the PlainSec briefing for 2026-09-24
Every edition of this story: DepthFirst Exploit Puts Ubuntu Containers on Alert