CVE-2026-80521: Linux kernel container escape A public exploit chains an AF_UNIX socket garbage-collector use-after-free into host

CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket garbage collector that breaks container isolation: a public exploit chains the memory bug from inside an unprivileged container to code execution as host root. Reports from late September 2026 tie the practical exposure to Ubuntu kernels, with 22.04 among the referenced affected lines, making multi-tenant container hosts the immediate concern.

The significance is the escalation path rather than the primitive alone. AF_UNIX is core kernel plumbing used everywhere, so the flaw is reachable from ordinary container workloads without exotic configuration, and the existence of a public exploit removes the theoretical margin. An attacker who escapes the container lands on the host kernel, where they can reach the Docker socket, other containers' volumes, and the node's credentials, including cloud metadata identities.

There is no vendor patch referenced in the reporting yet, so mitigation is configuration and detection until kernel updates land. Restrict privileged containers and host-PID or host-network pods, avoid mounting the Docker socket into workloads, and alert on namespace and userns anomalies. Watch for Ubuntu kernel updates referencing CVE-2026-80521, for the exploit being folded into worm tooling, and for additional distributions confirming affected kernel versions.