Loading vulnerability…
CVE-2026-80521 is a use-after-free vulnerability in the Linux kernel AF_UNIX socket garbage collector. A race between publication of AF_UNIX descriptor-passing graph edges and queuing of the socket buffer can cause garbage collection to partially free a strongly connected component. The vertex's cached SCC list entry remains linked after the vertex is freed. A later fast SCC traversal can follow that stale list entry and dereference freed unix_vertex memory. The vulnerable implementation was introduced in Linux 6.10 and backported to the 6.1 and 6.6 stable branches.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This 16-file C/Bash repository contains two destructive, target-specific Linux kernel container-escape PoCs plus tooling to build and run them only within disposable QEMU Ubuntu guests. The root Makefile builds static x86-64 binaries in pocs/CVE-2026-52910 and pocs/CVE-2026-80521. CVE-2026-52910 includes poc.c, a cBPF-JIT filter generator, and generated filter data; it races reuseport classic-BPF program replacement and uses kernel-address-specific JIT spraying to redirect execution via core_pattern. CVE-2026-80521 includes a KASLR/direct-map prefetch side-channel helper and documentation describing an AF_UNIX SCC garbage-collection use-after-free induced through SCM_RIGHTS descriptor-graph races, heap grooming, and object reclamation. The latter directory's Makefile references poc.c, although that source file is not present in the supplied file listing. vm/build_image.sh downloads and checksum-verifies Ubuntu cloud images, provisions Docker in a golden guest image, and vm/run_container.sh boots a temporary QCOW2 overlay, transfers the selected binary over loopback SSH, and runs it in a network-disabled Docker container. The repository is standalone and not a Metasploit, Nuclei, or other exploit-framework module.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity Linux kernel AF_UNIX socket garbage-collector use-after-free caused by a stale cached SCC-list pointer. It enables a default-capability container escape and host-root compromise through a public, target-specific proof of concept.
A CVSS 7.8 use-after-free race condition in the Linux kernel AF_UNIX socket garbage collector. An attacker running in a container can trigger it using ordinarily permitted system calls to escape the container and obtain root privileges on the host.
A Linux kernel AF_UNIX garbage-collection race condition in which a newly published socket edge can be visible to GC before its skb is queued. This can lead to partial freeing of a dead strongly connected component (SCC), leaving a stale scc_entry that a subsequent GC traversal may iterate through. The fix unlinks scc_entry before freeing the vertex in unix_del_edge().
A network-reachable, low-complexity vulnerability requiring no privileges or user interaction, with high impacts to confidentiality, integrity, and availability (CVSS v3 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The content identifies Debian Linux 12.0, 13.0, and 14.0 in its CPE information, but does not identify the vulnerable component or flaw type.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.