Security firm DepthFirst published a working proof-of-concept exploit on September 22 for CVE-2026-80521, a use-after-free in the Linux kernel’s AF_UNIX socket subsystem that allows a process running inside a container to escape to the host and gain root privileges. The upstream Linux kernel fixed the bug on August 6, but Ubuntu has not shipped the patch for any of its current Long-Term Support releases. The PoC targets Ubuntu 26.04 specifically, and DepthFirst confirmed that 24.04 and 22.04 are also vulnerable.
The practical risk is highest in multi-tenant environments — container platforms, cloud workloads, and development infrastructure — where other users or services run in adjacent containers on the same host. An attacker who achieves code execution inside any container on an affected Ubuntu host can use the PoC to reach out of that isolation boundary and take full control of the underlying machine. Ubuntu’s own security tracker lists all three affected LTS releases as “vulnerable, work in progress,” meaning a patch is in progress but has not yet been shipped. CVSS rates the flaw 7.8.
How to check if you’re affected
Affected products include Ubuntu 26.04, 24.04, and 22.04 LTS — including cloud-optimized kernel variants for AWS, Azure, and GCP workloads. Check the running kernel version with uname -r; if you are on one of those releases and have not applied a post-August 6 Ubuntu security update addressing CVE-2026-80521, the system is vulnerable. As a temporary mitigation, restrict who can run containers on multi-tenant hosts; Ubuntu has not yet provided an official workaround. Monitor Ubuntu’s security advisory tracker for the patch release.