DepthFirst's AF_UNIX exploit takes host root out of a default-configured Ubuntu container
The kernel fixed CVE-2026-80521 on August 6. Ubuntu has shipped nothing for 22.04, 24.04 or 26.04, including its AWS, Azure and GCP kernels, and DepthFirst's exploit for 26.04 went public on September 22.
The Watch · Security desk
What happened
- CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket subsystem, rated CVSS 7.8, and it lets an unprivileged process in a container gain root on the host.
- The kernel fixed the bug upstream on August 6, and Ubuntu has not shipped that patch for its 26.04, 24.04 or 22.04 LTS releases.
- 24.04 and 22.04 are affected through newer kernel packages, including the ones built for AWS, Azure and GCP workloads.
- CISA has not listed the flaw in its Known Exploited Vulnerabilities catalog, and no attacks using it have been confirmed.
Why it matters
- Who's exposed exposure On a multi-tenant Kubernetes node running an affected Ubuntu kernel, any container an attacker can execute code in is a route to root over every other workload on that host.
- Who has to decide decision With no vendor patch and no workaround published, platform teams pick between building the upstream patch into their own kernel images and moving untrusted workloads onto per-workload kernels such as Firecracker or Kata Containers.
- What doesn't add up contradiction DepthFirst says defenders must assume attackers can escape containers at will, while the public record shows no observed exploitation, and the exploit that exists is written for one release.
- What it sets up precedent This is the third kernel container escape of 2026 tied to AI-assisted research, so escape primitives landing before distribution patches is the case to budget against.
Next story · Build · yesterday
Ubuntu 26.10 ships a near-final Linux 7.3 and finishes the Rust coreutils switchConfirmed2 publishers
The AF_UNIX garbage collector reclaims file descriptors that processes pass to each other in SCM_RIGHTS messages [8]. DepthFirst describes a race in that collector: it can see new references before the data carrying them has been queued, free part of a linked group of sockets, and leave a pointer to the freed memory on a persistent internal list [10]. The next collection pass follows that pointer [10]. Every step uses syscalls a default container is permitted to make, and AF_UNIX is allowed by default in both Docker and Kubernetes seccomp profiles [9]. Namespace isolation, cgroup limits and seccomp filtering do not stop it [11].
DepthFirst won a Google kernelCTF slot with the exploit on July 24 and reported the bug to the kernel security team on August 5 [17]. The fix landed upstream the next day, in mainline kernel 7.2 and stable branch 7.1.10 [13][23]. The research and the exploit went out on September 22, 47 days after that commit, with Ubuntu's tracker still marking the 26.04 kernel "vulnerable, work in progress" [5][22] and no date published for the distribution update [12].
The firm credits its own model, dfs-large1, trained for vulnerability detection, working alongside a human-operated test harness [16]. Kernel maintainers replied that a researcher at OpenAI had independently reported the same bug, according to DepthFirst's timeline [18]. The CVE commit credits kernel-exploitation researcher Kyle Zeng as the reporter [19].
The exposure extends past Ubuntu. The vulnerable code entered the kernel at 6.10 and was backported to the 6.1 and 6.6 stable branches [14], so any distribution shipping those branches without the August patch is in the same position. Ubuntu is the one with public exploit code written against it [4]. Operators running an affected kernel can apply the upstream patch directly [12].
DepthFirst's assessment goes beyond this one bug. The firm argues organizations should stop treating containers as a security boundary [25]. "The barrier to escaping containers by attacking the kernel has fallen so significantly that we must assume attackers can do so at will," the company said [26]. Its supporting number is volume: LinuxCVETracker counts nearly 5,700 Linux kernel CVEs published in 2026, the highest annual total on record [21]. Across the 265 days to September 22 that is roughly 21 a day [24]. Two other container escapes this year, a futex bug disclosed in July and a flaw in the kernel's cryptographic subsystem in April, also came out of AI-assisted research [20].
What to watch
- Ubuntu moving 26.04's linux package off "work in progress" to a published advisory, and whether the AWS, Azure and GCP kernel variants ship on the same day.
- A KEV listing or a first confirmed in-the-wild case, either of which changes this from patch-when-ready to a dated obligation.
- The exploit being ported to 24.04 and 22.04 kernels, or to the 6.1 and 6.6 stable branches other distributions ship.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket subsystem, with a CVSS score of 7.8, that can be used to escape a container and gain root on the host.
- [2]
DepthFirst published the research on September 22.
- [3]
The flaw was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04 or 22.04 LTS releases.
- [4]
DepthFirst released exploit code targeting Ubuntu 26.04.
- [5]
Ubuntu's security tracker lists the Linux package on 26.04 as "vulnerable, work in progress", and no fix has shipped on any affected release.
- [6]
The 24.04 and 22.04 releases are also affected through newer kernel packages, including those for AWS, Azure and GCP workloads.
- [7]
The flaw is not in CISA's Known Exploited Vulnerabilities catalog, and there are no confirmed reports of attacks using it.
- [8]
The vulnerability sits in the kernel's garbage collector for AF_UNIX sockets, which cleans up file descriptors passed between processes through SCM_RIGHTS messages.
- [9]
AF_UNIX sockets handle local communication between processes and are allowed by default in Docker and Kubernetes seccomp profiles, which is why the flaw can be reached from inside a container.
- [10]
A race condition lets the collector see new references before the data carrying them has been queued; if it runs during that window it can free part of a group of linked sockets without removing a pointer from a persistent internal list, and the next collection pass follows that pointer into freed memory.
- [11]
Because the exploit reaches the kernel through ordinary system calls that containers are allowed to make, it bypasses namespace isolation, cgroup limits and seccomp filtering.
- [12]
Organizations running an affected kernel can apply the upstream patch directly; Ubuntu's tracker shows "work in progress" with no published date for the distribution update.
- [13]
The upstream fix landed on August 6 in mainline kernel 7.2 and stable branch 7.1.10.
- [14]
The vulnerable code was introduced in kernel 6.10 and was also backported to stable branches 6.1 and 6.6.
- [15]
Neither DepthFirst nor Ubuntu has published a temporary workaround, and DepthFirst recommends moving untrusted workloads to microVM isolation such as Firecracker or Kata Containers, which give each workload its own kernel rather than sharing the host's.
- [16]
DepthFirst said its AI model, dfs-large1, trained for vulnerability detection, found the flaw alongside a human-operated testing harness.
- [17]
DepthFirst won a Google kernelCTF slot with the exploit on July 24 and reported the bug to the kernel security team on August 5.
- [18]
The kernel maintainers replied that a researcher at OpenAI had independently reported the same bug, according to DepthFirst's timeline.
- [19]
The CVE commit credits kernel-exploitation researcher Kyle Zeng as the reporter.
- [20]
A futex vulnerability disclosed in July and a flaw in the kernel's cryptographic subsystem in April also allowed an unprivileged user to escalate to root on the host, and both discoveries involved AI-assisted research.
- [21]
Nearly 5,700 Linux kernel CVEs have been published in 2026, the highest annual total on record, according to LinuxCVETracker.
- [22]
DepthFirst's September 22 publication came 47 days after the August 6 upstream fix, with no Ubuntu fix shipped in between.
- [23]
The upstream fix landed one day after DepthFirst reported the bug to the kernel security team.
- [24]
Nearly 5,700 Linux kernel CVEs over the 265 days from January 1 to September 22 is roughly 21 a day.
- [25]
DepthFirst argues that AI-accelerated vulnerability discovery has lowered the barrier to container escapes to the point that organizations should not treat containers as a security boundary.
- [26]
"The barrier to escaping containers by attacking the kernel has fallen so significantly that we must assume attackers can do so at will," the company said.
Sources
2 independent publishers whose own reporting we read for this story.
- Ubuntu Container Escape Vulnerability Gets Public Exploit Before Kernel Patch Arrives | Linux Journal
linuxjournal.com
1 article
- thehackernews.comExploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape
2 articles · September 23, 2026