Exploit Code Published for Unpatched Ubuntu Container Escape Flaw

A use-after-free condition in the Linux kernel's AF_UNIX socket subsystem enables what security teams call a container escape: an attacker inside a container can break out and gain root privileges on the underlying host. Security firm DepthFirst said in research published September 22 that the vulnerability, tracked as CVE-2026-80521 with a Common Vulnerability Scoring System severity score of 7.8, was fixed upstream on August 6, but Ubuntu has not yet shipped that fix to its 26.04, 24.04, or 22.04 LTS releases. DepthFirst has released proof-of-concept exploit code that targets Ubuntu 26.04.

The flaw sits in the kernel's garbage collector for AF_UNIX sockets. AF_UNIX sockets handle local communication between processes on the same machine, and seccomp (secure computing mode) profiles, which filter which system calls a process may use, allow them by default in Docker and Kubernetes. That default is why the flaw can be reached from inside a container without special permissions. The garbage collector cleans up file descriptors passed between processes through SCM_RIGHTS messages, which let one process hand another process access to an open file. A race condition lets the garbage collector see new references before the data carrying them has been queued. If the collector runs during that window, it can free part of a group of linked sockets without removing a pointer from a persistent internal list. The next collection pass follows that pointer into memory that has already been freed, a classic use-after-free condition.

The vulnerable code was introduced in kernel 6.10 and also backported to stable branches 6.1 and 6.6. The upstream fix landed on August 6 in mainline kernel 7.2 and stable branch 7.1.10. Ubuntu's security tracker currently lists the Linux package on 26.04 as 'vulnerable, work in progress.' The 24.04 and 22.04 LTS releases are also affected through newer kernel packages, including those used by AWS, Azure, and GCP cloud workloads. No fix has shipped on any affected release, and the tracker gives no published date for a distribution update.

Because the exploit reaches the kernel through ordinary system calls that containers are allowed to make, it bypasses namespace isolation that separates processes, control group limits that restrict resource use, and seccomp filtering. In other words, the usual container boundaries that separate processes, restrict resource use, and filter system calls do not stop this attack. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, and there are no confirmed reports of attacks using it in the wild.

Neither DepthFirst nor Ubuntu has published a temporary workaround. Organizations running an affected kernel can apply the upstream patch directly, but for many Ubuntu users that means waiting for the distribution update. DepthFirst recommends moving untrusted workloads to microVM isolation such as Firecracker or Kata Containers. Those technologies give each workload its own lightweight kernel instead of sharing the host's kernel, which closes the container escape path.

DepthFirst said its AI model, dfs-large1, trained for vulnerability detection, found the flaw alongside a human-operated testing harness. The company won a Google kernelCTF slot with the exploit on July 24 and reported the bug to the kernel security team on August 5. Kernel maintainers replied that a researcher at OpenAI had independently reported the same bug, according to DepthFirst's timeline. The CVE commit credits kernel-exploitation researcher Kyle Zeng as the reporter.

The disclosure is the latest in a series of 2026 kernel flaws that allow attackers to escape containers. A futex vulnerability disclosed in July and a flaw in the kernel's cryptographic subsystem in April also allowed an unprivileged user to escalate to root on the host. Both discoveries involved AI-assisted research. DepthFirst argues that AI-accelerated vulnerability discovery has lowered the barrier to container escapes to the point that organizations should not treat containers as a security boundary. 'The barrier to escaping containers by attacking the kernel has fallen so significantly that we must assume attackers can do so at will,' the company said. Nearly 5,700 Linux kernel CVEs have been published in 2026, the highest annual total on record, according to LinuxCVETracker. The demonstrated exploit and the rising volume are the basis for the company's assessment.

For website owners and IT teams who run containerized workloads, this research is a reminder that the Linux kernel itself is a critical patch target. If you use containers as a security boundary between tenants or between a web application and the host, you should treat the host kernel as part of the attack surface and apply upstream fixes quickly when available. Website owners who use a managed hosting service like AEU Hosting rather than maintaining their own Ubuntu servers outsource much of this patching work, so they should confirm with their provider that affected kernel updates are applied when available. Until Ubuntu ships the fixed packages, the safest paths are microVM isolation or moving untrusted workloads away from shared kernels.