Topic
Security flaws in the Linux kernel, the privileged core shared by all processes and containers on a host; exploits can give local root or container escape.
DepthFirst published a working Ubuntu 26.04 exploit for CVE-2026-80521 on 2026-09-22, before distribution kernels carried a fix, according to a dev.to post. The flaw sits in AF_UNIX, which default Docker and Kubernetes seccomp profiles permit.
Reality
The kernel fixed CVE-2026-80521 on August 6. Ubuntu has shipped nothing for 22.04, 24.04 or 26.04, including its AWS, Azure and GCP kernels, and DepthFirst's exploit for 26.04 went public on September 22.
Reality
Hyunwoo Kim says a guest can use the bug to run code on the host, and he reports a local-root variant where /dev/kvm is world-openable. Both need ARM64 nested virtualization, a mode that is off by default.
Reality
CISA has confirmed exploitation of three Linux kernel flaws without publishing how, and the three entries do not triage the same way, because Red Hat's interim advice covers kTLS and ebtables but not the AF_ALG race.
Reality
CISA added CVE-2026-53362 to its exploited-vulnerabilities catalog on August 27. The single published account of the bug says the escape needs only unprivileged code on the node plus permission to open a UDP socket, which almost nothing is denied.
Reality