Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

Summary: DepthFirst published research on September 22 showing that a use-after-free in the Linux kernel's AF_UNIX socket subsystem, tracked as CVE-2026-80521 with a CVSS score of 7.8, can be used to escape a container and gain root on the host, and it released exploit code targeting Ubuntu 26.04. The flaw was fixed upstream on August 6 in mainline kernel 7.2 and stable branch 7.1.10, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases, with its tracker listing 26.04 as 'vulnerable, work in progress' and no fix shipped on any affected release.
Bottom line: AF_UNIX sockets are allowed by default in Docker and Kubernetes seccomp profiles, so the exploit reaches the kernel through ordinary system calls and bypasses namespace isolation, cgroup limits, and seccomp filtering - meaning the container boundary your architecture depends on does not hold on unpatched Ubuntu hosts, including AWS, Azure, and GCP kernel packages.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-80521
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026