Published on September 23, 2026
Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape
Severity
High
Security researchers from DepthFirst disclosed a Linux kernel vulnerability tracked as CVE-2026-80521, which can allow an attacker inside a container to escape the container boundary and obtain root-level privileges on the underlying host.
The vulnerability is a use-after-free / race-condition flaw in the AF_UNIX socket subsystem of the Linux kernel. It affects the garbage collector responsible for cleaning up file descriptors passed between processes through SCM_RIGHTS.
The vulnerability was fixed upstream on August 6, 2026, but Ubuntu had not yet released the corresponding security update for Ubuntu 26.04, 24.04 LTS, and 22.04 LTS at the time of disclosure. DepthFirst also released working exploit code targeting Ubuntu 26.04.
How?
The vulnerability exists within the Linux kernel’s AF_UNIX socket garbage collector. AF_UNIX sockets are commonly used for local inter-process communication and are permitted by default in common Docker and Kubernetes security configurations.
The attack involves manipulating linked UNIX sockets and triggering a race condition during the kernel’s garbage-collection process.
During the race condition, the garbage collector can observe a new socket reference before the corresponding data has been properly queued. If the collector runs during this window, it may free part of a linked socket group without removing a pointer from an internal list.
A subsequent garbage-collection cycle can then follow the stale pointer into freed memory, resulting in a use-after-free condition.
An attacker who successfully exploits vulnerability can potentially gain control over kernel memory and escape the container’s isolation boundary. The resulting privileges are at the host root level, allowing the attacker to potentially access resources and workloads outside the compromised container.
The attack is particularly relevant to containerized environments because the vulnerable AF_UNIX functionality can be reached through ordinary system calls that are permitted by common container security configurations.
The vulnerability can therefore bypass several container isolation mechanisms, including:
- Container namespaces
- cgroup restrictions
- Standard seccomp filtering
DepthFirst developed a working exploit and demonstrated vulnerability through Google’s kernelCTF environment on July 24, 2026. The vulnerability was subsequently reported to the Linux kernel security team on August 5, 2026.
The upstream fix was committed on August 6, 2026, with the vulnerability affecting code introduced in Linux kernel 6.10 and subsequently backported to the 6.1 and 6.6 stable branches.
Conclusion
CVE-2026-80521 demonstrates the security risks associated with relying on shared Linux kernels as the primary isolation boundary for containerized workloads. A local attacker who obtains execution inside a vulnerable container may be able to exploit the Linux kernel’s AF_UNIX subsystem to escape the container and obtain root privileges on the underlying host.
The availability of working public exploit increases the importance of identifying vulnerable Ubuntu and Linux kernel versions, particularly on Docker, Kubernetes, cloud-hosted container, and multi-tenant environments.
Organizations should prioritize updating affected Linux kernel packages once the vendor fixes become available. Until patches are available, DepthFirst recommends considering stronger workload isolation mechanisms such as microVM-based isolation, including Firecracker or Kata Containers, which provide separate kernels for workloads. No temporary workaround had been published by Ubuntu or DepthFirst at the time of disclosure.
Security teams should also monitor for suspicious activity originating from containers, unexpected kernel-related crashes, abnormal AF_UNIX socket activity, and attempts by container processes to interact with host-level resources.
Source
https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html