Ubuntu unpatched for Linux kernel container escape (CVE-2026-80521)

Affected Systems

Linux kernel versions 6.10+ (including stable branches 6.1 and 6.6). Ubuntu 26.04, 24.04 LTS, and 22.04 LTS remain unpatched. Affects AWS, Azure, and GCP kernel packages. Fixed upstream in kernel 7.2 and 7.1.10 on August 6, 2026.

Exploitation Status

Public exploit available. DepthFirst released working exploit code targeting Ubuntu 26.04 on September 22, 2026. No confirmed in-the-wild attacks reported. Not listed in CISA KEV catalog.

Business Impact

Unprivileged container users can escape to host root via AF_UNIX socket use-after-free. Bypasses namespace isolation, cgroup limits, and seccomp filters in Docker and Kubernetes default configurations. CVSS 7.8. Ubuntu security tracker shows "work in progress" with no patch ETA. No workaround published.

Urgency

🟠 Within 24 hours

Recommended Actions

• Apply upstream kernel patch directly if running affected kernel versions (6.1, 6.6, 6.10+) on Ubuntu 26.04, 24.04 LTS, or 22.04 LTS.
• Monitor Ubuntu security tracker for CVE-2026-80521 patch availability and deploy immediately when released.
• Migrate untrusted or multi-tenant container workloads to microVM isolation (Firecracker, Kata Containers) to isolate kernel attack surface.
• Audit container deployments on AWS, Azure, and GCP for affected Ubuntu kernel packages and prioritize patching or isolation.
• Review container runtime logs for unusual AF_UNIX socket activity or unexpected privilege escalation attempts.