Full Report
A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22. The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. DepthFirst
Analysis Summary
# Vulnerability: Linux Kernel AF_UNIX Subsystem Container Escape
## CVE Details
- CVE ID: CVE-2026-80521
- CVSS Score: 7.8 (High)
- CWE: Use-After-Free (CWE-416)
## Affected Systems
- **Products:** Linux Kernel, Ubuntu Linux (including cloud-specific kernels for AWS, Azure, and GCP workloads)
- **Versions:**
- Vulnerable code introduced in Linux kernel version 6.10.
- Backported to stable branches 6.1 and 6.6.
- Ubuntu versions 26.04, 24.04, and 22.04 LTS are currently unpatched ("work in progress").
- **Configurations:** Systems running containers (e.g., Docker, Kubernetes) where default seccomp profiles allow standard AF_UNIX socket communication.
## Vulnerability Description
A use-after-free vulnerability exists in the Linux kernel's garbage collector for the AF_UNIX socket subsystem. This component is responsible for cleaning up file descriptors passed between local processes via `SCM_RIGHTS` messages.
A race condition within the garbage collector allows it to detect new references before the corresponding data carrying them has been fully queued. If the garbage collector runs during this specific execution window, it can free a portion of a group of linked sockets without removing the associated pointer from a persistent internal list. A subsequent collection pass then follows this dangling pointer into freed memory.
Because AF_UNIX sockets are permitted by default in standard container runtimes to facilitate local communication, an attacker inside a container can leverage ordinary system calls to trigger this flaw. This allows the exploit to completely bypass namespace isolation, cgroup limits, and seccomp filtering.
## Exploitation
- Status: PoC available (Exploit code targeting Ubuntu 26.04 has been publicly released by security firm DepthFirst. It is not currently listed in CISA's KEV catalog, and there are no confirmed reports of wild exploitation.)
- Complexity: Medium to High (Requires exploiting a precise kernel race condition, though the availability of public exploit code lowers the operational barrier.)
- Attack Vector: Local (Triggered from within a container or an unprivileged local user session via standard system calls.)
## Impact
- Confidentiality: High (Full container escape leading to root privileges on the host system.)
- Integrity: High (Complete modification of host system resources and underlying infrastructure.)
- Availability: High (Potential for host-level kernel crashes and denial of service.)
## Remediation
### Patches
- **Upstream Linux Kernel:** Fixed on August 6, 2026, in mainline kernel version 7.2 and stable branch 7.1.10. Backported fixes are also available for stable branches 6.1 and 6.6. Organizations managing their own kernels should apply the upstream commit directly.
- **Ubuntu Linux:** No official patch has been shipped yet for Ubuntu 26.04, 24.04, or 22.04 LTS. The vendor tracker lists these updates as a "work in progress."
### Workarounds
- Neither DepthFirst nor Ubuntu has published a direct configuration workaround.
- **Architecture Mitigation:** DepthFirst strongly recommends migrating untrusted or multi-tenant workloads away from shared-kernel containers to microVM isolation solutions, such as Firecracker or Kata Containers, which allocate a dedicated kernel to each workload.
## Detection
- **Indicators of Compromise:** Monitor for anomalous or high-frequency local socket creation and `SCM_RIGHTS` message passing, which may indicate attempts to win the garbage collection race condition.
- **Detection Methods:** System call auditing (e.g., via Auditd or eBPF-based security tools like Cilium Tetragon) can be configured to flag unusual AF_UNIX activity originating from within container namespaces.
## References
- Ubuntu Security Tracker: hxxps://ubuntu[.]com/security/CVE-2026-80521
- Upstream Linux Kernel Commit: hxxps://git[.]kernel[.]org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=594d905195024b228c962627ae5ae7c17bd582a4
- Public Exploit Repository: hxxps://github[.]com/Markakd/Container_escape
- DepthFirst Research Announcement: hxxps://depthfirst[.]com/research/containers-are-no-longer-safe
- Linux CVE Announcement: hxxps://ratatoskr[.]run/linux-cve-announce/2026/08/17465107
- Developer Technical Reference: hxxps://x[.]com/Markak_/status/2102478278594543807