526/69 Thursday, September 24, 2026
Researchers from DepthFirst have disclosed technical details and exploit code for CVE-2026-80521, a Linux Kernel vulnerability with a CVSS score of 7.8. The flaw is a use-after-free vulnerability in the AF_UNIX subsystem. The published exploit was tested against Ubuntu 26.04 LTS and can be used from within a container to escape its isolation boundary and gain root privileges on the host system. Ubuntu has stated that kernels used by Ubuntu 26.04 and 24.04 are affected and that fixes are still being prepared.
The vulnerability is caused by a race condition in the AF_UNIX garbage collection process when handling file descriptors passed through SCM_RIGHTS, which may cause the kernel to access memory that has already been freed. Because containers share the host system’s kernel, an attacker who can execute code inside a container may exploit the flaw to escalate privileges and gain access to the host. The upstream Linux Kernel project released a patch on August 6, 2026. However, at the time the exploit was publicly disclosed, Ubuntu had not yet released patches for some affected kernel versions.
Administrators using Ubuntu should check their deployed kernels against the Ubuntu Security Tracker, as the impact varies depending on the Ubuntu release and kernel version in use. Ubuntu 26.04 LTS and 24.04 LTS still have affected kernels, while the main kernel used by Ubuntu 22.04 LTS is not affected. However, some HWE and cloud kernel variants for Ubuntu 22.04 remain listed as vulnerable. For systems where a patch is not yet available, administrators should consider using workloads with stronger kernel isolation from the host, such as Firecracker or Kata Containers, particularly for untrusted workloads, to reduce the risk of container escape while awaiting security updates.
Source: https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html