Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

A use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem has been assigned CVE-2026-80521 and given a CVSS base score of 7.8. According to research published by security firm DepthFirst on September 22, 2026, the bug can be leveraged to escape a container and achieve root-level access on the underlying host. The vulnerability stems from improper handling of socket operations in the kernel, specifically a use-after-free condition that arises during specific AF_UNIX socket interactions.

The upstream kernel fix was released on August 6, 2026. However, Ubuntu has not yet incorporated the patch into its Long Term Support releases, including Ubuntu 22.04, 24.04, and 26.04 LTS. DepthFirst's publication includes proof-of-concept exploit code, increasing the risk of active exploitation against unpatched systems.

Containerized environments running affected Ubuntu versions are particularly at risk, as the vulnerability allows bypassing the isolation guarantees provided by Linux containers. An attacker with the ability to create and manipulate AF_UNIX sockets within a container could exploit the flaw to break out of the container boundary and execute code with host privileges.

Ubuntu security teams have not publicly confirmed a timeline for delivering the fix to affected LTS releases. Users are advised to monitor official Ubuntu security advisories and apply upstream kernel patches if they have the capability to rebuild kernels from source.