CVE-2026-80521

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) Ubuntu versions 22.04 through 26.04

Description A use-after-free issue exists in the AF UNIX socket subsystem during the garbage collection (GC) of unix sockets. The flaw occurs when the GC mechanism identifies new references before the data carrying them has been queued. If the GC runs during this window, it may partially free a strongly connected component (SCC) without removing a pointer from a persistent internal list. A subsequent collection cycle can then free that pointer into already freed memory. This can be triggered by concurrently calling send() to create a new edge and close() on the sockets. Specifically, the unix add edges() function may publish a new edge to the GC before the socket buffer is queued by skb queue tail(). If the GC is triggered, it may judge the SCC as dead but fail to free it entirely, leading to a scenario where unix walk scc fast() iterates over a freed scc entry via unix del edge().

This issue allows a low-privileged process inside a container to achieve arbitrary kernel read/write access, overwrite the modprobe path variable, and escape the container to gain root privileges on the host. The vulnerability is reachable through syscalls allowed by default Docker and Kubernetes seccomp profiles and may require CAP NET ADMIN or access to a user namespace.

Recommendations Update the Linux kernel to the version released on August 6 or later. Apply the kernel updates from the Canonical -proposed or -security pockets for Ubuntu 22.04, 24.04, and 26.04 LTS. Drop CAP NET ADMIN from container runtimes where possible. Use seccomp profiles to block unshare(CLONE NEWUSER) if not required. Monitor for modprobe path overwrite attempts using auditd rules on /proc/sys/kernel/modprobe.