Google publishes Linux kernel exploit for privilege escalation

CVE-2026-80521: Linux kernel AF_UNIX use-after-free privilege escalation has been fixed in the 7.1.10 stable line, with upstream patches also backported to several older stable branches. The issue is a use-after-free in the AF_UNIX socket garbage collection mechanism: a race in the garbage collector can leave a freed kernel object linked in a cached ring, allowing a local user to gain root privileges.

Google’s kernelCTF programme published full technical details and a working exploit for the CVE, describing a repeatable kmalloc-96 use-after-free that can be chained to execute code with kernel privileges. The write‑up notes the exploit does not require a ROP chain or a separate KASLR leak; the public PoC and write‑up are available via kernelCTF and Google’s security research pages. Kyle Zeng is credited with reporting the bug to kernel developers.

Affected versions include Linux 6.10 through 7.1.9, with backported and related stable releases noted as 6.1.141 through 6.1.188, 6.6.93 through 6.6.157, and other backports. The flaw is fixed upstream in Linux 7.2 and in stable releases 7.1.10, 6.18.53, 6.12.111, 6.6.158, and 6.1.189. Patching requires installing the distribution’s kernel update that contains the fix and rebooting; no narrow syscall filter can block this vulnerability, and blocking AF_UNIX or SCM_RIGHTS would disrupt many programmes.

The article emphasises there have been no confirmed exploit occurrences in the wild to date and that the vulnerability is not yet listed in CISA KEV.