In the Linux kernel

CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket garbage collector, introduced when the GC was rewritten to use a Strongly Connected Component (SCC) graph model in kernel 6.10 (later backported to 6.1.x and 6.6.x stable branches). When unix_del_edge() frees a vertex, it fails to call list_del_init(&vertex->scc_entry), leaving a dangling pointer in the cached SCC list. The next GC pass follows that pointer into freed memory. An unprivileged process inside a default Docker or Kubernetes container can win this race deterministically, reclaim the freed slab with controlled data, forge a fake vertex with a skb destructor pointing to call_umh_work, and land an interactive root shell on the host. Affected kernels span 6.1.x, 6.6.x, and 6.10 through 7.1.9; the fix landed upstream on August 6, 2026 in 7.1.10 and 7.2.

The vendor CVSS of 7.8 HIGH undervalues this bug dramatically. The vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H treats it as a standard local privilege escalation, but it ignores the container-escape dimension entirely — S:U (Scope: Unchanged) is wrong when the exploit crosses namespace, cgroup, and seccomp boundaries from an unprivileged container to host root. DepthFirst published a working exploit on September 22, 2026 — yesterday — and no Ubuntu LTS release has shipped a patch for any of its supported kernels, including AWS, Azure, and GCP variants. This is a zero-day gap for the most popular server Linux distribution.

1. Drop CAP_NET_RAW from all containers immediately — The DepthFirst exploit requires CAP_NET_RAW for the AF_PACKET TPACKET_V1 physical page oracle that enables reliable slab reclamation and KASLR bypass. Dropping this capability degrades the exploit from deterministic code execution to a probabilistic kernel panic (DoS). In Docker: --cap-drop=NET_RAW. In Kubernetes: set securityContext.capabilities.drop: ["NET_RAW"] or enforce Pod Security Standards Restricted. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.
2. Restrict /proc/kpagecount and /proc/kpageflags access from containers — The exploit uses /proc/kpagecount as a physical page oracle to bypass KASLR and slab randomization. Mask or block these proc interfaces from container mount namespaces using AppArmor/SELinux profiles or OCI runtime configuration. Deploy within 3 days.
3. Enforce Kubernetes Pod Security Standards Restricted on all namespaces — PSS Restricted drops CAP_NET_RAW and applies additional constraints that degrade the exploit chain. For clusters not yet using PSS, this is the single most impactful policy change. Apply namespace-level enforcement via pod-security.kubernetes.io/enforce: restricted labels. Deploy within 3 days.
4. Deploy Falco or Tetragon runtime detection rules — Add rules to detect: (1) rapid AF_UNIX socket creation (>100/sec from a single container), (2) large SCM_RIGHTS batches (252+ descriptors), (3) AF_PACKET RX-ring allocations from containers, (4) /proc/kpagecount reads from non-init namespaces, (5) unexpected process spawns outside container namespace hierarchy. These provide detection-in-depth while patches are unavailable. Deploy within 3 days.
5. Migrate untrusted and multi-tenant workloads to microVM isolation — Firecracker, Kata Containers, or gVisor provide a hardware-level isolation boundary that kernel-level container escapes cannot cross. This is the only complete mitigation until kernel patches ship. Prioritize CI/CD runners, multi-tenant SaaS workloads, and any container running third-party or user-supplied code. Begin migration within 3 days; complete within 30 days.
6. Apply upstream kernel 7.1.10 or 7.2 manually where distro patches are unavailable — The upstream fix (commit 594d9051) is a one-line list_del_init() addition. For organizations with kernel build capability, cherry-picking or upgrading to 7.1.10/7.2 eliminates the vulnerability entirely. Test thoroughly before deploying to production — this is a kernel update. Target within 3 days for critical container hosts; deploy fleet-wide within noisgate remediation SLA of 90 days.

Run this script on each target Linux host (not inside a container) as any user with read access to /proc/version_string and uname. No special privileges required. Example: chmod +x check_cve_2026_80521.sh && ./check_cve_2026_80521.sh

#!/bin/bash
# CVE-2026-80521 Checker — af_unix SCC entry use-after-free
# Checks if the running kernel is in the affected version range.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

KERNEL_VERSION=$(uname -r)
MAJOR=$(echo "$KERNEL_VERSION" | cut -d. -f1)
MINOR=$(echo "$KERNEL_VERSION" | cut -d. -f2)
PATCH=$(echo "$KERNEL_VERSION" | cut -d. -f3 | cut -d- -f1)

echo "[*] CVE-2026-80521 Check"
echo "[*] Running kernel: $KERNEL_VERSION"
echo ""

# Vuln introduced in 6.10 (commit 4090fa37), backported to 6.1.x and 6.6.x stable.
# Fixed in 7.1.10 and 7.2.

# Check if kernel has the fix applied via changelog/patch marker
if [ -f /proc/version ]; then
    PROC_VERSION=$(cat /proc/version)
else
    PROC_VERSION=""
fi

vulnerable=0

if [ "$MAJOR" -lt 6 ]; then
    echo "[+] Kernel $MAJOR.x predates the vulnerable SCC GC rewrite (6.10)."
    echo "PATCHED"
    exit 0
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -lt 1 ]; then
    echo "[+] Kernel 6.$MINOR.x predates backported SCC GC code."
    echo "PATCHED"
    exit 0
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -ge 1 ] && [ "$MINOR" -le 6 ]; then
    # 6.1.x and 6.6.x received backports of the vulnerable SCC code
    echo "[!] Kernel 6.$MINOR.x received SCC GC backport — likely VULNERABLE."
    vulnerable=1
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -ge 10 ]; then
    # 6.10+ is where the SCC GC was originally introduced
    echo "[!] Kernel 6.$MINOR.x contains original SCC GC code — VULNERABLE."
    vulnerable=1
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 0 ]; then
    echo "[!] Kernel 7.0.x predates the fix (7.1.10 / 7.2) — VULNERABLE."
    vulnerable=1
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 1 ]; then
    if [ -n "$PATCH" ] && [ "$PATCH" -ge 10 ]; then
        echo "[+] Kernel 7.1.$PATCH contains the fix (>=7.1.10)."
        echo "PATCHED"
        exit 0
    else
        echo "[!] Kernel 7.1.$PATCH predates the fix (7.1.10) — VULNERABLE."
        vulnerable=1
    fi
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -ge 2 ]; then
    echo "[+] Kernel 7.$MINOR.x contains the fix (>=7.2)."
    echo "PATCHED"
    exit 0
elif [ "$MAJOR" -gt 7 ]; then
    echo "[+] Kernel $MAJOR.x is newer than the fix."
    echo "PATCHED"
    exit 0
else
    echo "[?] Could not determine vulnerability status for kernel $KERNEL_VERSION."
    echo "UNKNOWN"
    exit 2
fi

if [ "$vulnerable" -eq 1 ]; then
    # Additional check: see if distro backported the fix
    # Look for the fix commit message in kernel changelog if available
    FIX_MARKER="594d905195024b228c962627ae5ae7c17bd582a4"
    PATCHED_BY_DISTRO=0
    if command -v dpkg &>/dev/null; then
        CHANGELOG="/usr/share/doc/linux-image-${KERNEL_VERSION}/changelog.Debian.gz"
        if [ -f "$CHANGELOG" ]; then
            if zgrep -q "$FIX_MARKER" "$CHANGELOG" 2>/dev/null || zgrep -q "CVE-2026-80521" "$CHANGELOG" 2>/dev/null; then
                PATCHED_BY_DISTRO=1
            fi
        fi
    elif command -v rpm &>/dev/null; then
        if rpm -q --changelog kernel-"$KERNEL_VERSION" 2>/dev/null | grep -q "CVE-2026-80521"; then
            PATCHED_BY_DISTRO=1
        fi
    fi

    if [ "$PATCHED_BY_DISTRO" -eq 1 ]; then
        echo "[+] Distro has backported the CVE-2026-80521 fix."
        echo "PATCHED"
        exit 0
    fi

    # Check if containers are running (amplifies risk)
    CONTAINER_RISK=""
    if command -v docker &>/dev/null && docker info &>/dev/null 2>&1; then
        RUNNING=$(docker ps -q 2>/dev/null | wc -l)
        if [ "$RUNNING" -gt 0 ]; then
            CONTAINER_RISK=" ($RUNNING Docker containers running — container escape risk is ACTIVE)"
        fi
    fi
    if command -v crictl &>/dev/null; then
        PODS=$(crictl pods -q 2>/dev/null | wc -l)
        if [ "$PODS" -gt 0 ]; then
            CONTAINER_RISK=" ($PODS Kubernetes pods running — container escape risk is ACTIVE)"
        fi
    fi

    echo ""
    echo "[!] VULNERABLE — kernel $KERNEL_VERSION is affected by CVE-2026-80521$CONTAINER_RISK"
    echo "[!] Upgrade to kernel >= 7.1.10 or >= 7.2, or apply distro patch when available."
    echo "VULNERABLE"
    exit 1
fi

1. The Hacker News — Exploit Released for Unpatched Ubuntu Linux Flaw
2. Ubuntu Security Tracker — CVE-2026-80521
3. The CyberSec Guru — Ubuntu Kernel Flaw Lets Containers Escape to Host Root
4. ByteIota — Ubuntu's Unpatched Container Escape Has a Public Exploit
5. Ratatoskr — Upstream Patch (af_unix: Unlink scc_entry in unix_del_edge)
6. OpenCVE — CVE-2026-80521 Details
7. OSV — CVE-2026-80521
8. Privacy Needle — Ubuntu Linux Flaw Enables Container Escape