Exploit Published for Unpatched Ubuntu Flaw: Container Escape to Host Root

On September 22, security firm DepthFirst published research on a Linux kernel vulnerability that allows an attacker to escape a container and gain root on the host. Alongside it, the researchers released working exploit code targeting Ubuntu 26.04.

The flaw is tracked as CVE-2026-80521 (CVSS score 7.8) and is a use-after-free. It lives in the garbage collector for AF_UNIX sockets — the mechanism that cleans up file descriptors passed between processes via SCM_RIGHTS messages. Such sockets handle local inter-process communication and are allowed by default in Docker and Kubernetes seccomp profiles, which is exactly why the bug can be reached from inside a container.

The root cause is a race condition: the garbage collector can see new references before the data carrying them has been queued. If a collection pass hits that window, part of a group of linked sockets is freed without the pointer being removed from an internal list. The next pass follows that dangling pointer into freed memory. Because the attack runs through ordinary system calls that containers are permitted to make, it bypasses namespace isolation, cgroup limits, and seccomp filtering.

Ubuntu still unpatched

The fix landed in mainline kernel 7.2 and stable branch 7.1.10 back on August 6. The vulnerable code was introduced in kernel 6.10 and backported to stable branches 6.1 and 6.6. Yet Ubuntu's security tracker still marks the kernel package on 26.04 as "vulnerable, work in progress." The 24.04 and 22.04 releases are also affected through newer kernel packages, including builds for AWS, Azure, and GCP workloads. As of publication, no fix has shipped for any affected release.

The flaw is not yet in CISA's Known Exploited Vulnerabilities catalog, and there are no confirmed attacks. Neither DepthFirst nor Ubuntu has offered a temporary workaround; the researchers advise moving untrusted workloads into microVM isolation such as Firecracker or Kata Containers, which give each workload its own kernel rather than sharing the host's.

Found with AI help

DepthFirst says the bug was found by its dfs-large1 model, trained for vulnerability detection, together with a human-operated testing harness. The company won a Google kernelCTF slot with the exploit on July 24 and reported the bug to the kernel security team on August 5. It turned out an OpenAI researcher had independently found the same bug, and the CVE commit credits exploitation researcher Kyle Zeng as the reporter.

This is not the first container escape via the kernel in 2026: a July futex flaw and an April flaw in the cryptographic subsystem offered similar capabilities, and both were also found with AI assistance. DepthFirst concludes that AI-accelerated vulnerability discovery has lowered the barrier so far that containers can no longer be treated as a security boundary. According to LinuxCVETracker, nearly 5,700 Linux kernel CVEs have been published in 2026 — the highest annual total on record.

Source: The Hacker News