Linux Kernel Flaw Lets Attackers Escape Containers and Run Code

Security researchers have disclosed CVE-2026-80521, a high-severity Linux kernel vulnerability rated CVSS 7.8 that can allow an unprivileged attacker to escape a container and potentially execute code on the host. The flaw affects the AF_UNIX socket family’s garbage collection of SCM_RIGHTS messages. According to researcher Zhenpeng Lin of DepthFirst AI, a timing error allows a socket graph edge to be exposed before its message is safely queued.

If garbage collection then frees a vertex without removing it from its persistent `scc_entry` ring, a later pass can dereference the stale pointer, causing use-after-free memory corruption. The article says technical details and working exploit code are public, including an exploit demonstrated during Google’s kernelCTF competition in July 2026, although there is no confirmed exploitation by criminal groups in the wild.

Listed affected builds include commits `4090fa373f0e763c43610853d2774b5979915959`, `5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a`, `de7921631ff323369aa63a4324695ab54ea4047e`, and versions `6.1.141`, `6.6.93` and `6.10`. Testing reportedly showed the exploit working on Ubuntu 26.04, with potential implications for isolation tools including nsjail, Firejail and Bubblewrap.

Administrators should apply a kernel containing the listed fixes, including `1293fd69a50d188a5788b08ba3741a3e86be1608`, `fe198b077864feafd4aa4b33b1a5ce26f50195a2`, `e3702470ced94fad74d71e2232f022d2eb752a6d` and `594d905195024b228c962627ae5ae7c17bd582a4`. The article also recommends microVM-based isolation for untrusted, multi-tenant workloads while patching.