Ubuntu Still Shipping a Kernel Bug That Lets Containers Break Out to Root

Key points

• Ubuntu 24.04 and 26.04 are still listed as vulnerable to CVE-2026-80521 more than seven weeks after the fix merged upstream on August 6, while Ubuntu 22.04 is marked not affected by Canonical's own tracker.
• The bug is a use-after-free in the kernel code that cleans up Unix domain sockets, a way programs on the same machine talk to each other.
• Security firm DepthFirst published exploit research on September 22 showing the flaw can be used to escape a container and take over the host as root.
• The upstream patch, written by Google's Kuniyuki Iwashima, credits Kyle Zeng for the original report and simply unlinks a stale entry before the kernel frees it.
• CVE-2026-80521 carries a CVSS severity score of 7.8 out of 10 and needs local access, not a network connection, to trigger.

This is one of those bugs where the fix is three lines and the exposure window is measured in weeks.

The Linux kernel patch landed in Torvalds' tree on August 6, authored by Kuniyuki Iwashima at Google, after researcher Kyle Zeng worked out that the kernel's garbage collector for Unix sockets could free part of a data structure while another part still pointed at it. That's the classic shape of a use-after-free, where the operating system reuses memory that some other piece of code still thinks it owns. That kind of mistake in kernel code is usually a path to root.

DepthFirst published research on September 22, picked up by The Hacker News, turning that theoretical flaw into a working container escape. A program running inside what is supposed to be a sealed-off container, the lightweight boxes that cloud providers and Kubernetes clusters use to isolate jobs, can reach out and become the administrator of the whole physical machine underneath.

Which Ubuntu versions are exposed?

Canonical's own tracker lists 24.04 LTS "noble" and 26.04 LTS "resolute" as vulnerable, with a fix still in progress. Ubuntu 22.04 "jammy" is marked not affected, because the buggy garbage collector rewrite was never backported that far.

The releases most likely to be running modern container hosts are the ones still waiting. That's the awkward part.

We reported on a structurally similar local-to-root container escape in "Eighteen-Year-Old Bug in Linux Networking Code Hands Attackers the Keys to the Machine" on 7 August, where fixed kernels had already shipped before we filed. Here, they haven't.

What does the bug actually do?

The flaw lives in af_unix, the kernel subsystem behind Unix domain sockets. Two sockets can end up in a cycle where each holds a reference to the other, and the kernel runs a garbage collector to spot and clean up those cycles when the sockets close.

Zeng found a narrow race. A sending program can publish a new edge in that reference graph a fraction of a second before the kernel actually queues the message. If both sockets close in that gap, the garbage collector marks the pair as dead and frees one of them. The next collection run then walks a list still pointing at freed memory. Iwashima's fix is to unlink the stale entry before the kernel lets go of the vertex.

The National Vulnerability Database entry for CVE-2026-80521 rates it 7.8, high severity, requiring only local access.

Should you worry?

If you run Ubuntu 24.04 or 26.04 hosts with untrusted workloads, treat this as a live exposure. Public exploit code plus an unpatched distribution is exactly the combination attackers wait for.

Watch Canonical's advisory page for the kernel update and apply it the moment it lands. In the meantime, tightening seccomp profiles on container runtimes to restrict socket and sendmsg calls on AF_UNIX will make the race far harder to hit, though it'll break some legitimate workloads. Hosts running only trusted first-party code are lower risk. Multi-tenant boxes aren't.

MFA wouldn't have helped here. This is an authorization boundary failing inside the kernel itself, and the only real fix is the patch.