Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

A use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem is now exploitable, allowing attackers to escape containers and achieve root access on the host system. The vulnerability, tracked as CVE-2026-80521 (CVSS score: 7.8), was addressed upstream on August 6, but Ubuntu has not yet applied the patch to its older releases (26.04, 24.04, and 22.04 LTS). Security firm DepthFirst discovered the flaw using its AI model, dfs-large1, alongside a human-operated testing harness, and won a Google kernelCTF slot on July 24.

DepthFirst’s research indicates a concerning trend: the barrier to escaping containers by attacking the kernel has fallen significantly. The vulnerability lies within the kernel's garbage collector for AF_UNIX sockets, which cleans up file descriptors passed between processes through SCM_RIGHTS messages. Because AF_UNIX sockets handle local communication between processes and are allowed by default in Docker and Kubernetes seccomp profiles, the flaw can be reached from inside a container, bypassing namespace isolation, cgroup limits, and seccomp filtering.

The upstream fix landed on August 6 in mainline kernel 7.2 and stable branch 7.1.10. The vulnerable code was introduced in kernel 6.10 and backported to stable branches 6.1 and 6.6. DepthFirst recommends moving untrusted workloads to microVM isolation, such as Firecracker or Kata Containers, which give each workload its own kernel. Neither DepthFirst nor Ubuntu has published a temporary workaround.

This discovery is part of a series of 2026 kernel vulnerabilities, with nearly 5,700 CVEs published to date, representing a record high. The increasing volume and demonstrated exploit highlight the need for organizations to reassess their container security strategies.