DepthFirst published exploit code on 22 September for CVE-2026-80521, a use-after-free in the Linux kernel's AF_UNIX socket garbage collector (CVSS 7.8) that lets code inside a container escape namespace isolation, cgroup limits and seccomp filtering to gain root on the host. The flaw was fixed upstream on 6 August in mainline kernel 7.2 and stable 7.1.10, and the vulnerable code — introduced in kernel 6.10 and backported to 6.1 and 6.6 — is still unpatched on Ubuntu 26.04, 24.04 and 22.04 LTS, where the security tracker lists the package as "vulnerable, work in progress"; AWS, Azure and GCP kernel packages on those releases inherit it. The reach is the point: AF_UNIX sockets are permitted by default in Docker and Kubernetes seccomp profiles, so the exploit arrives through ordinary system calls a container is already entitled to make, and a race condition in the collector frees linked sockets while a pointer survives in a persistent internal list. The bug is not in CISA's KEV catalog and there are no confirmed in-the-wild attacks; no vendor workaround has been published, and the advisory recommends not running untrusted workloads on affected kernels.

• Source article