Threat Intelligence

Unpatched Ubuntu Kernel Flaw Lets Attackers Escape Containers and Take Over the Host

The Hacker News · 23 Sept 2026

Key Takeaway If your business runs containerised workloads on Ubuntu, especially shared or multi-tenant environments, monitor for an official patch and consider stronger isolation methods until one is released.

Security firm DepthFirst has published research and working exploit code for a serious Linux kernel vulnerability, tracked as CVE-2026-80521, that allows an attacker to break out of a container and gain root control of the underlying host. The flaw was fixed in the upstream Linux kernel on 6 August, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases, including versions used on AWS, Azure, and GCP cloud workloads.

The bug is a use-after-free error in how the kernel manages AF_UNIX sockets, a mechanism used for communication between processes on the same system. Because these sockets are allowed by default in standard Docker and Kubernetes security profiles, the flaw can be triggered from inside an ordinary container using normal system calls. This means it can bypass the usual isolation protections such as namespaces, cgroups, and seccomp filtering that are meant to keep containers separated from the host.

There is no evidence yet of the flaw being used in real attacks, and it is not currently listed in CISA's Known Exploited Vulnerabilities catalog. However, with exploit code now public and no official Ubuntu patch or workaround available, the risk of exploitation is expected to rise. DepthFirst suggests that organisations running untrusted workloads consider stronger isolation methods, such as microVM technologies like Firecracker or Kata Containers, which give each workload its own separate kernel.

Linux container security vulnerability Ubuntu cloud security

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.