Exploitation observed; activity peaked at 12 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in unix_del_edge().
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
| Date | Total | Labels |
|---|
| 2026-08-27 | 1 | Disclosure1 |
| 2026-08-29 | 2 | Disclosure1Patch1 |
| 2026-09-22 | 1 | PoC1 |
| 2026-09-23 | 12 | Active Exploitation1Disclosure4Exploit2Patch1PoC4 |
| 2026-09-24 | 8 | Exploit6General1PoC1 |
| 2026-09-25 | 6 | Disclosure5Patch1 |
| 2026-09-26 | 2 | Exploit2 |
| 2026-09-27 | 2 | Patch1PoC1 |
| 2026-09-28 | 5 | Disclosure4Exploit1 |
| 2026-09-29 | 1 | Disclosure1 |
Linux kernel use-after-free vulnerability in the AF_UNIX subsystem (CVE-2026-80521) (@Markak_) https://depthfirst.com/research/containers-are-no-longer-safe #infosec #Linux https://t.co/HYzKA8kpsh
Post summary
The tweet announces a Linux kernel use-after-free vulnerability (CVE-2026-80521) in the AF_UNIX subsystem, linking to a research article for further information without mentioning exploits, patches, or active exploitation.
🚨 PUBLIC EXPLOIT RELEASED FOR LINUX KERNEL CONTAINER ESCAPE — CONTAINER USER CAN REACH ROOT ON HOST DepthFirst has published technical details and exploit code for CVE-2026-80521, a Linux kernel AF_UNIX use-after-free that can break the container security boundary. • Exploitation starts from unprivileged code inside a container and can yield root on the underlying host • The vulnerable AF_UNIX functionality is reachable through syscalls allowed by default Docker/Kubernetes seccomp profiles • DepthFirst used the bug to compromise a Google kernelCTF target in July • The flaw was reported to http://kernel.org in August; researchers learned it had independently been reported by Kyle Zeng of OpenAI • An upstream Linux kernel fix was released August 6 • DepthFirst published its full research and exploit on September 22 • Ubuntu tracks CVE-2026-80521 as affecting relevant releases; downstream patch status should be checked rather than assuming the upstream fix is already deployed • No confirmed in-the-wild exploitation has been identified ⚠️ Analyst Note: This is especially relevant to multi-tenant container infrastructure. Containers share the host kernel, so a kernel escape can turn compromise of one workload into root access to the underlying node and potentially expose neighboring workloads. The availability of public exploit material materially lowers the barrier for reproduction. Operators running untrusted or internet-facing container workloads should verify their actual host-kernel build and patch state now. Primary: https://depthfirst.com/research/containers-are-no-longer-safe #Linux #CVE202680521 #ContainerEscape #Docker #Kubernetes #Kernel #CloudSecurity #PoC #ThreatIntel #DDW #DarkWeb
Post summary
A public exploit for CVE-2026-80521, a Linux kernel AF_UNIX use-after-free enabling container escape to host root, has been released with technical details and code; an upstream fix exists but deployment status should be verified.
Vulnerabilidad en kernel de Ubuntu permite escapar se contenedores Canonical aún no ha solucionado un grave error del kernel de Ubuntu (CVE-2026-80521) con puntuación CVSS 7.8 https://blog.elhacker.net/2026/09/grave-error-sin-solucion-en-kernel-de.html
Güvenlik araştırmacısı @Markak_, CVE-2026-80521 için container escape PoC demosu paylaştı. Açık upstream'de 6 Ağustos'ta düzeltildi; ancak araştırmacıya göre Ubuntu 26.04'ün ilgili kernel'inde henüz backport edilmemiş durumda. Videoda ise, Ubuntu 26.04 (7.0.0-31-generic) çalışan bir container içinden exploit tetikleniyor. Payload birkaç pc-hijack denemesinden sonra container süreçleri yerine host süreçlerini listeliyor ve id çıktısı uid=0(root) dönüyor. Yani PoC, container izolasyonunu kırıp host'ta root alındığını canlı gösteriyor. Açık, Linux kernel'in AF_UNIX garbage collection mekanizmasındaki bir race condition / use-after-free'den kaynaklanıyor. Araştırmacı, CVE'yi dfs-large1 ile keşfettiğini, exploit'i ise GPT-5.6 Sol ile ürettiğini söylüyor. Wite up: https://depthfirst.com/research/containers-are-no-longer-safe https://x.com/Markak_/status/2102478278594543807/video/1
Post summary
The tweet shares a PoC demonstration for CVE-2026-80521, showing a container escape to root via a race condition/use-after-free in the Linux kernel's AF_UNIX garbage collection, noting an upstream fix from August 6 that lacks backport in Ubuntu 26.04.
🔴 CVE-2026-80521 ve CVE-2026-52910 için Linux container escape PoC'leri yayınlandı. PoC'ler, kernel açıklarını kullanarak container izolasyonunun aşılmasını hedefliyor ve sırasıyla Ubuntu 26.04 ile Ubuntu 24.04 üzerinde test edilmiş. https://github.com/Markakd/Container_escape
Post summary
The text announces the release of Proof of Concept (PoC) code for Linux container escape vulnerabilities (CVE-2026-80521 and CVE-2026-52910) targeting kernel vulnerabilities on Ubuntu 24.04 and 26.04, linking to a GitHub repository containing the exploit scripts.
A PoC/exploit has been discovered for vulnerabilities CVE-2026-52910 and CVE-2026-80521 PT ID: PT-2026-50928 Vendor: Linux Product: Linux Kernel Description: CVE-2026-52910 is a use-after-free vulnerability in the Linux kernel's reuseport classic BPF handling, while CVE-2026-80521 is a race condition in AF_UNIX garbage collection that can result in access to partially freed kernel objects. Exploitation of these vulnerabilities can allow an attacker with code execution inside a container to corrupt kernel memory and escape container isolation. References: • https://dbu.gs/vulnerability/PT-2026-50928 • https://github.com/Markakd/Container_escape
Post summary
The post discloses that a proof-of-concept/exploit for Linux kernel CVEs CVE-2026-52910 and CVE-2026-80521 has been discovered, detailing the vulnerabilities and providing a GitHub link to the exploit code.
9/18以降に追っているのは正確にはLPE 8件です。 CVE-2026-80844 CVE-2026-81000 CVE-2026-68121 CVE-2026-74469 CVE-2026-74753 CVE-2026-52910 CVE-2026-80521 CVE未採番：RustyTux / strparser・ESP-in-TCP race LPE 9/23まで、これ全部緩和策がわかるものとRed hatに報告した。異常すぎる密度だよ。
Post summary
The tweet discloses a series of eight LPE CVEs (including an uncensored one) and notes that mitigation details are known and reported to Red Hat, indicating a straightforward announcement rather than a PoC, exploit, or active exploitation claim.
Missing from the timeline above, the CVE wasn't issued until August 26th: https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80521-2b35@gregkh/ , 3 weeks after the fix was already public. So can bring in lack of tracking, prioritization, the weird insistence on an imaginary wall between security@ and cve@, and downstreams..
Post summary
The text highlights the delayed issuance of CVE-2026-80521, emphasizing procedural issues like lack of tracking and prioritization in the CVE process.
JUST ONE MORE REJIG bro trust me Putting in a hand rolled graph walk into core kernel was SO important bro you don't understand, it's secure now, I promise https://github.com/Markakd/security-research/blob/kernelctf-exp557-cve-2026-80521/pocs/linux/kernelctf/CVE-2026-80521_lts/docs/vulnerability.md 🥱
Post summary
The tweet shares a link to a Proof of Concept for CVE-2026-80521 hosted in a GitHub repository's pocs directory, without mentioning exploits, patches, or active exploitation.
Your container shares a kernel, and this week that mattered. CVE-2026-80521 escapes to root on the host. Upstream fixed it August 6. Ubuntu still has 26.04 in progress and 24.04 open. 22.04 and older are not affected.
Post summary
The tweet discloses CVE‑2026-80521 as a kernel privilege escalation that lets a container escape to root on the host, notes an upstream fix on August 6, and reports that Ubuntu 24.04 and 26.04 are still vulnerable with patches in progress while older versions are unaffected.
🐳 CONTAINER ESCAPE TO ROOT: Linux kernel AF_UNIX use-after-free (CVE-2026-80521)! Unprivileged container processes can escape cgroups to gain root on host Kubernetes nodes. 👉 Exploit mechanics & patch: https://sh3llc0d3.com/blog/container-escape-alert-how-the-linux-kernel-af_unix-bug-shatters-cloud-isolation-cve-2026-80521/ #sh3llc0d3 #shellcode #Kubernetes #Linux
Post summary
The tweet discloses a Linux kernel AF_UNIX use-after-free vulnerability (CVE-2026-80521) that allows unprivileged container processes to gain root on Kubernetes nodes, and points to a blog for exploit mechanics and patch information.
Details for a critical Linux container escape flaw are public. Discover how this Linux container escape flaw works and review key mitigation steps. #LinuxKernel #ContainerEscape #CVE202680521 #Cybersecurity #Infosec #CloudSecurity https://securityonline.info/linux-container-escape-flaw-cve-2026-80521/
Post summary
The tweet announces that details for a critical Linux container escape flaw (CVE-2026-80521) are publicly available and encourages readers to learn how it works and review mitigation steps via a linked article.
A container isn’t a wall. It’s a process sharing the host’s Linux kernel. CVE-2026-80521 is a good reminder of that. A kernel bug in AF_UNIX can potentially turn code running inside a container into a host-level compromise. https://t.co/pGQQ6pQWfL
CVE-2026-80521 en Ubuntu 26.04 permite a procesos sin privilegios explotar un fallo UAF en AF_UNIX, escapar de contenedores Docker o Kubernetes y obtener root en el host real. Mas información: https://www.ecucert.gob.ec/wp-content/uploads/2026/10/Al-2026-051-Vulnerabilidad-de-alta-severidad-en-Ubuntu-26.04-permite-escape-de-contenedores-%E2%80%93-CVE-2026-80521.pdf #PorUnEcuadorCiberseguro @Arcotel_ec @CsirtCEDIA @CsirtEPN https://t.co/zzqxzBySaW
5/7 Linux containers - CVE-2026-80521. This is more interesting than another kernel LPE: unprivileged container -> kernel UAF -> host root. A public exploit demonstrated the escape on Ubuntu 26.04. Shared kernel = shared blast radius.
Post summary
The text discloses CVE-2026-80521 as a kernel UAF vulnerability in Linux containers enabling unprivileged container escape to host root, noting that a public exploit has already been demonstrated on Ubuntu 26.04.
Security roundup — Sep 24. Sources: cPanel https://support.cpanel.net/hc/en-us/articles/43591715125271-Security-CVE-2026-87899-Vulnerability-in-cPanel-s-CalDAV-CardDAV-September-22-2026 Linux https://ubuntu.com/security/CVE-2026-80521 F5 https://my.f5.com/manage/s/article/K000162605 VCO https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 WP https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp Thread ↓
Post summary
A security roundup tweet aggregating links to five vendor security advisories covering multiple CVEs, directing users to vendor pages for details and fixes rather than disclosing new exploits or technical findings.
if you run untrusted code in containers on ubuntu, the kernel is your boundary right now, and it has a public escape. cve-2026-80521: a use-after-free in af_unix socket gc. container to host root, public exploit for 26.04. fixed upstream aug 6, not yet shipped by ubuntu. seccomp won't save you. af_unix is allowed by the default docker and kubernetes profiles. today: 1. list which nodes run untrusted or multi-tenant workloads: ci runners, agent sandboxes, customer code 2. check kernel versions. the bug came in with 6.10 and was backported to 6.1 and 6.6 3. if you build your own kernels, pick up the upstream fix (7.1.10+) 4. give untrusted workloads their own kernel: firecracker or kata microvms 5. watch ubuntu's cve tracker and patch the day it lands caveat: no confirmed attacks yet and it's not in cisa kev. the exploit being public is the clock, not the attacks. containers are packaging. isolation is a separate decision. https://depthfirst.com/research/containers-are-no-longer-safe
Post summary
The post describes CVE-2026-80521 as a kernel container-escape use-after-free with a public exploit, affected kernel versions, and mitigation steps, while explicitly stating that active exploitation has not been confirmed.
AF_UNIX is in the default docker and kubernetes seccomp profiles. CVE-2026-80521 is a use-after-free in unix socket gc. public exploit. upstream patched 6 aug. ubuntu 26.04 tracker still says work in progress. a container is a namespace. it is not a kernel fence.
Post summary
The text discloses CVE-2026-80521 as a use-after-free in the Unix socket garbage collector with a public exploit available, noting the upstream kernel was patched on August 6th while Ubuntu 26.04 remediation is still in progress.
🚨 PUBLIC EXPLOIT RELEASED FOR AN UNPATCHED UBUNTU CONTAINER ESCAPE Researchers have published exploit code for: CVE-2026-80521 CVSS: 7.8 / High The flaw is a use-after-free in Linux's AF_UNIX socket subsystem. Potential path: Code execution inside container ↓ Kernel memory corruption ↓ Escape isolation ↓ ROOT on Ubuntu host The bug was fixed upstream in Linux in August. But Ubuntu's tracker still lists affected kernel packages as vulnerable or awaiting fixes on relevant releases. DepthFirst released working exploit code targeting Ubuntu 26.04. Important: ❌ No confirmed exploitation in the wild ❌ Not currently in CISA KEV But once working exploit code becomes public, the threat model changes quickly. CyberSignal insight: A container is not a security boundary if the kernel underneath it can be crossed. Source: Ubuntu · DepthFirst · The Hacker News #Linux #ContainerSecurity #Cybersecurity
Post summary
The post announces the public release of a working exploit (by DepthFirst) for CVE-2026-80521, a high-severity container escape vulnerability in Ubuntu, while explicitly noting no active exploitation in the wild yet.
📝 CVE-2026-80521: The Ubuntu Container Escape Is Not Just an Ubuntu Problem A public exploit breaks out of default @Docker and @kubernetesio containers through a bug in the AF_UNIX https://devops-daily.com/posts/af-unix-container-escape-cve-2026-80521 #DevOps #Linux