Containers Are No Longer a Security Boundary (CVE-2026-80521)

What it is

CVE-2026-80521 is a heap use-after-free in the Linux kernel's AF_UNIX garbage collector, exploitable for container escape and reachable from unprivileged, in-container code paths (SCM_RIGHTS file-descriptor passing over UNIX sockets). The summary names it; what it omits is the patch state and the exact ordering flaw that makes it fire.

How it works

Two behaviors combine. First, the send path publishes SCM graph edges before the skb carrying the references is queued — scm_stat_add() calls unix_add_edges() (which briefly takes/releases unix_gc_lock) ahead of __skb_queue_tail(). This lets the GC interrupt the send and see edges for an skb still off-queue, which it cannot collect. Second, when GC purges a collected message, unix_del_edge() moves a vertex whose out-degree hits zero onto a free list — but nothing unlinks that vertex from its persistent scc_entry ring. If a sibling socket in the same SCC survives (via that off-queue skb), its ring keeps a pointer to the freed vertex; the next GC pass walks the stale ring in unix_walk_scc_fast() and dereferences freed memory.

The turning point is the survivor: no off-queue skb → no surviving vertex → no stale ring pointer → no UAF.

flowchart TD
  A[Send: unix_add_edges publishes edges] --> B[GC interrupts before skb queued]
  B --> C[GC frees vertex via unix_del_edge]
  C --> D{Sibling in SCC survives?}
  D -- yes, off-queue skb --> E[scc_entry ring keeps freed pointer]
  E --> F[Next GC: unix_walk_scc_fast UAF]
  D -- no --> G[No dangling ring, safe]

Preconditions / Affected

• Reachable from inside standard containers (Docker/Kubernetes) and OS sandboxes (nsjail, Firejail, Bubblewrap) — all share the host kernel; default seccomp profiles do not block the AF_UNIX/SCM_RIGHTS paths involved.
• Working container-escape exploit released (on GitHub) against Ubuntu 26.04, plus a separate exploit for CVE-2026-52910 against Ubuntu 24.04.

What to do

• The upstream patch was released 8/6/2026 (kernelCTF slot lts-6.12.95). The authors state it was still unpatched in Ubuntu 26.04 as of publication (9/22/2026) — verify your distro has backported it rather than assuming currency; the page's whole argument is that distro backport lag leaves a live window.
• For untrusted/multi-tenant workloads, migrate to microVM isolation (Firecracker, Kata Containers) so a kernel zero-day compromises only one ephemeral guest kernel, not the shared host.

Caveats

The sweeping "containers are no longer a boundary" framing rests partly on trend data the reader should weight rather than take as proof: 5,976 Linux kernel CVEs in 2026 through mid-September, and 13 of 36 publicly disclosed kernelCTF CVEs reachable from unprivileged interfaces (epoll, futex, POSIX timers, AF_UNIX). The claim that frontier models can "one-shot" exploit generation, and the referenced "OpenAI Hugging Face incident," are asserted, not substantiated on the page. The same bug was independently reported by a researcher at OpenAI (per the timeline), which corroborates the finding's reality.