Linux AF_UNIX CVE-2026-80521 (CVSS 7.8): host-root container escape; Ubuntu 26.04/24.04 still unpatched (exploit public)
Ubuntu security tracker for CVE-2026-80521 (publication 26 August 2026; last updated 21 September 2026) rates CVSS 3 severity 7.8 High (Ubuntu priority Medium): heap use-after-free in the kernel AF_UNIX garbage collector (unix_del_edge / scc_entry unlink) when SCM_RIGHTS file descriptors race with close. Reachable via ordinary socket syscalls allowed in default Docker/Kubernetes seccomp profiles, so a container process can escape to host root. Upstream fix landed 6 August 2026 (mainline commit credited to reporter Kyle Zeng). DepthFirst (research post; Google kernelCTF slot 24 July 2026) published exploit details and points to public exploit code; no confirmed in-the-wild exploitation and not in CISA KEV as of THN 23 Sep check. Ubuntu status (tracker): linux 26.04 resolute Vulnerable/work-in-progress; 24.04 noble Vulnerable; stock 22.04 jammy linux Not affected — but several HWE/cloud kernel packages on jammy (e.g. linux-aws-6.8, linux-azure-6.8) are Vulnerable. No Ubuntu temporary workaround published; DepthFirst recommends microVM isolation (Firecracker/Kata) for untrusted workloads until distro kernels ship. Primary: Ubuntu CVE tracker; research: DepthFirst; wire: The Hacker News 23 Sep 2026.
- Product
- Linux kernel AF_UNIX SCM_RIGHTS garbage collector (Docker/Kubernetes/seccomp default profiles)
- Versions
- Vulnerable code path introduced ~kernel 6.10 (also backported to some 6.1/6.6 stables per THN/DepthFirst coverage). Ubuntu tracker: linux 26.04 Vulnerable WIP; 24.04 Vulnerable; 22.04 stock linux Not affected; selected jammy cloud/HWE kernels (e.g. linux-aws-6.8, linux-azure-6.8) Vulnerable. Upstream fixed 6 Aug 2026; Ubuntu packages not yet released as of tracker 21 Sep 2026.
- CVSS
- 7.8 (CVSS 3 High; Ubuntu tracker)
- Exploited in Australia?
- unknown
- Patch to
- Monitor Ubuntu CVE-2026-80521 for package release on 26.04/24.04 and affected cloud/HWE kernels; until then restrict untrusted containers on shared hosts, prefer microVM isolation (Firecracker/Kata) for high-risk workloads, and consider applying the upstream AF_UNIX unix_del_edge fix where custom kernels are controlled; hunt is low-signal without Ubuntu USN yet
Primary: Ubuntu Security — CVE-2026-80521 AF_UNIX UAF / container escape (updated 21 Sep 2026) · Vendor: Canonical Ubuntu — CVE-2026-80521 tracker · CVE: CVE-2026-80521 · DepthFirst — CVE-2026-80521 research / exploit context (THN amplify 23 Sep 2026)