Loading story…
A public exploit targets CVE-2026-80521, a use-after-free vulnerability in the Linux kernel's AF_UNIX socket garbage collector that lets an unprivileged process escape a default Docker or Kubernetes container and obtain root privileges on its host. The bug leaves a stale scc_entry list pointer after a unix_vertex is freed, enabling the socket garbage-collection walk to dereference freed memory and bypass container namespace, cgroup, and seccomp isolation.
DepthFirst released research and working exploit code targeting Ubuntu 26.04; Ubuntu 26.04, 24.04, and 22.04 LTS—including affected cloud-kernel variants—reportedly had not distributed fixes. The vulnerability is reachable through ordinary AF_UNIX socket calls allowed by default Docker and Kubernetes seccomp profiles. Upstream fixed the issue in Linux 7.1.10 and 7.2; organizations should deploy patched host kernels and reboot, while using reduced capabilities, PFN-interface restrictions, resource limits, or microVM isolation as interim mitigations. No confirmed in-the-wild exploitation has been reported.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
DepthFirst published research and proof-of-concept exploit code for CVE-2026-80521 targeting Ubuntu 26.04. The exploit demonstrated that an unprivileged process in default Docker or Kubernetes configurations could escape a container and gain host-root access.
An upstream fix for the AF_UNIX garbage-collector use-after-free landed in Linux 7.1.10 and 7.2. The fix removes a vertex's cached SCC list entry before it can be freed, preventing later garbage-collection walks from dereferencing it.
DepthFirst reported the vulnerability later designated CVE-2026-80521 to the Linux kernel security team. An OpenAI researcher independently reported the same issue to kernel maintainers.
DepthFirst obtained a Google kernelCTF slot with its exploit for the AF_UNIX container-escape vulnerability.
The vulnerable AF_UNIX socket garbage-collector implementation was introduced in Linux kernel 6.10 and later backported to the Linux 6.1 and 6.6 stable branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity Linux kernel use-after-free vulnerability, tracked as **CVE-2026-53361** (CVSS 7.1), affects the AF_UNIX socket garbage collector and can allow an unprivileged local attacker to corrupt kernel memory and escape a container. The flaw is a race condition in which concurrent `MSG_PEEK` operations retain a reference to an in-flight file descriptor that the garbage collector fails to account for, potentially leaving a dangling `sk_buff` after a live socket is freed. Technical details and public proof-of-concept exploit code, including work described as `BAD_GARBAGE.c`, have been released. No confirmed in-the-wild exploitation has been reported, but organizations running shared, multi-tenant, or containerized Linux environments should apply upstream or stable backport fixes—available in stable kernel version 6.12.95 and later—then reboot affected hosts; access by untrusted local users should be restricted until patching is complete.
Aug 28, 2026
A long-standing Linux kernel flaw in SCTP Dynamic Address Reconfiguration, tracked as **CVE-2026-64564** and dubbed **SCTPhantom**, was disclosed as a deterministic use-after-free bug that can let a low-privileged local user gain **root** privileges and potentially escape from a container to the host. The vulnerability affects ASCONF handling, where a crafted sequence of `DEL-IP` operations can free an SCTP transport and later reuse the dangling pointer. Researchers said the vulnerable logic dates back to **Linux 2.6.25** and reported successful exploitation on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9-family systems, OpenCloudOS, and a Linux 7.2 release candidate, including multiple tested host-root container escapes. Fixes are available in mainline commit `9b2854f86f0b` and in stable kernel releases **6.6.148**, **6.12.101**, **6.18.42**, **7.1.6**, and **7.2-rc5**. Discussion on the oss-sec mailing list noted that practical exposure varies by distribution: on Rocky Linux 9 and RHEL 9-family systems, SCTP is typically not installed by default because it resides in the `kernel-modules-extra` package and is blacklisted for autoload, meaning administrators would generally need to explicitly install and load the module for the bug to be reachable. Defenders were urged to patch affected kernels or disable SCTP where it is not required.
Aug 12, 2026
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Aug 25, 2026