Linux AF_UNIX CVE-2026-80521 (CVSS 7.8): host-root container escape; Ubuntu 26.04/24.04 still unpatched (exploit public)
Ubuntu security tracker for CVE-2026-80521 (publication 26 August 2026; last updated 19 October 2026, checked 23 October) rates CVSS 3 severity 7.8 High (Ubuntu priority Medium): heap use-after-free in the kernel AF_UNIX garbage collector (unix_del_edge / scc_entry unlink) when SCM_RIGHTS file descriptors race with close. Reachable via ordinary socket syscalls allowed in default Docker/Kubernetes seccomp profiles, so a container process can escape to host root.
Upstream fix landed 6 August 2026 (mainline commit credited to reporter Kyle Zeng). DepthFirst (research post; Google kernelCTF slot 24 July 2026) published exploit details and points to public exploit code. Ubuntu status (tracker): linux 26.04 resolute Vulnerable/work-in-progress; 24.04 noble Vulnerable; stock 22.04 jammy linux Not affected — but several HWE/cloud kernel packages on jammy (e.g. linux-aws-6.8, linux-azure-6.8) are Vulnerable.
No Ubuntu temporary workaround published; DepthFirst recommends microVM isolation (Firecracker/Kata) for untrusted workloads until distro kernels ship. (sources: Ubuntu CVE tracker; DepthFirst)
Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Ubuntu CVE tracker; DepthFirst)
- Product
- Linux kernel AF_UNIX SCM_RIGHTS garbage collector (Docker/Kubernetes/seccomp default profiles)
- Versions
- Vulnerable code path introduced ~kernel 6.10. Ubuntu tracker: linux 26.04 Vulnerable (work in progress in 7.0.0-42.42); 24.04 Vulnerable (work in progress in 6.8.0-148.148); 22.04 stock linux Not affected; selected jammy cloud/HWE kernels (e.g. linux-aws-6.8, linux-azure-6.8) Vulnerable. Upstream fixed 6 Aug 2026; Ubuntu packages not yet released as of the tracker's 28 Oct 2026 update (checked 29 Oct 2026).
- CVSS
- 7.8 (CVSS 3 High; Ubuntu tracker)
- Exploited in Australia?
- unknown
- Patch to
- Monitor Ubuntu CVE-2026-80521 for package release on 26.04/24.04 and affected cloud/HWE kernels; until then restrict untrusted containers on shared hosts, prefer microVM isolation (Firecracker/Kata) for high-risk workloads, and consider applying the upstream AF_UNIX unix_del_edge fix where custom kernels are controlled; hunt is low-signal without Ubuntu USN yet