CVE-2026-80521: AF_UNIX use-after-free lets containers escape to host

A Linux kernel use-after-free in the AF_UNIX subsystem (CVE-2026-80521, rated 7.8) lets an unprivileged process inside a container reach the host. The upstream fix landed on August 6, 2026 and is present in 7.2 and 7.1.10, but Ubuntu 22.04, 24.04 and 26.04 LTS kernels, including AWS, Azure and GCP builds, had no distribution patch when the exploit went public on September 22.

• CVE-2026-80521 is an AF_UNIX use-after-free rated 7.8
• Working exploit for Ubuntu 26.04 published on September 22, 2026
• Upstream fix shipped in 7.2 and 7.1.10 on August 6
• Ubuntu LTS kernels for AWS, Azure and GCP lacked a patch