Cybersecurity
Exploit code targets Ubuntu container-escape flaw
DepthFirst said it found a Linux kernel use-after-free that could let a container reach host root, and it published exploit code while Ubuntu had not shipped fixes for affected releases.
- DepthFirst said the vulnerability was a use-after-free in the Linux kernel’s AF_UNIX socket subsystem that could let a container reach host root.
- The issue was tracked as CVE-2026-80521 with a CVSS score of 7.8, and the upstream fix landed on 6 August.
- Ubuntu had not shipped the patch for its 26.04, 24.04 or 22.04 LTS releases, and its tracker marked 26.04 as vulnerable, work in progress.
- It was absent from CISA’s Known Exploited Vulnerabilities list, and the article said there were no confirmed attacks.
- DepthFirst said it released exploit code for Ubuntu 26.04, and that its dfs-large1 model plus a human harness found the bug.
DepthFirst said on 22 September that a use-after-free in the Linux kernel’s AF_UNIX socket code could let a container break out and obtain root on the host. It also said it had published exploit code for Ubuntu 26.04.
Ubuntu’s tracker marked the 26.04 package as vulnerable and said work was under way. DepthFirst said the 24.04 and 22.04 LTS lines were also exposed through newer kernel builds, including cloud variants for AWS, Azure and GCP, and the article said there were no confirmed attacks.
The bug sat in the garbage-collection logic for AF_UNIX sockets, which handles file descriptors passed in SCM_RIGHTS messages. Because Docker and Kubernetes allow those sockets in their default seccomp profiles, the flaw could be reached from inside a container and could evade namespace, cgroup and seccomp controls.
The upstream patch arrived on 6 August in mainline 7.2 and stable 7.1.10. DepthFirst said the vulnerable code first appeared in kernel 6.10 and was later backported to 6.1 and 6.6, and it advised organisations to apply the upstream patch directly or move untrusted workloads to microVMs such as Firecracker or Kata Containers.
DepthFirst said its dfs-large1 model and a human testing harness found the issue, that it won a Google kernelCTF slot on 24 July, and that it reported the bug on 5 August. The kernel maintainers said an OpenAI researcher had independently reported the same bug, and the CVE commit credited Kyle Zeng.
Named in this story
People
- Kyle Zeng
- was credited in the CVE commit as the reporter
Companies
- DepthFirst
- said it found the flaw and released exploit code
Organisations
- Google kernelCTF
- gave DepthFirst the slot it said it won
- OpenAI
- had a researcher who had independently reported the same bug
- LinuxCVETracker
- supplied the 2026 Linux kernel CVE total
Governments and agencies
- CISA
- kept the flaw out of its Known Exploited Vulnerabilities list
Products and systems
- Ubuntu
- had affected releases that had not received the patch
- Linux kernel
- contained the vulnerable code and received the upstream fix
- AF_UNIX socket subsystem
- contained the use-after-free
- Docker
- allowed AF_UNIX sockets in its default seccomp profile
- Kubernetes
- allowed AF_UNIX sockets in its default seccomp profile
- Firecracker
- was cited as a microVM option for isolation
- Kata Containers
- was cited as a microVM option for isolation
- AWS
- was named in the affected Ubuntu kernel builds
- Azure
- was named in the affected Ubuntu kernel builds
- GCP
- was named in the affected Ubuntu kernel builds
How the source tells it
The piece was mainly technical, but it repeatedly leaned on alarm about container escape and on boosterish detail about DepthFirst’s AI research.
- Alarm the write-up foregrounds host-root escape, bypassed isolation controls and the lack of a shipped fix
- Boosterism DepthFirst’s AI model and competition win are used to frame the discovery