A critical vulnerability in the Linux kernel's AF_UNIX socket subsystem now has a public exploit, posing a severe risk of container escape to host-root access on systems running unpatched Ubuntu Long-Term Support (LTS) versions. Security firm DepthFirst disclosed the flaw, tracked as CVE-2026-80521, with a CVSS score of 7.8, on September 22, according to a report by The Hacker News.

The core issue is a use-after-free memory corruption flaw within the kernel. An attacker with local access can leverage this flaw to escalate privileges and break out of a container's isolation, ultimately gaining full root control over the host operating system. The risk is significantly elevated because a working exploit has been made publicly available.

Crucially, while a patch for the vulnerability was merged into the mainline Linux kernel on August 6, Ubuntu has not yet backported the fix to its 26.04, 24.04, or 22.04 LTS releases. This patch gap leaves the vast majority of Ubuntu-powered servers, both on-premises and in cloud environments, exposed to attack.

This development is particularly urgent for DevOps and Site Reliability Engineering (SRE) teams managing containerized workloads. Any environment where untrusted code can run inside a container on an unpatched Ubuntu host is potentially vulnerable. The publication of a public exploit lowers the skill barrier for attackers, increasing the likelihood of widespread exploitation.

DepthFirst's research highlights that the flaw resides in a core kernel component used for inter-process communication. Its presence across multiple, widely-deployed LTS versions means the vulnerability likely affects a significant portion of the global Linux server ecosystem.

Interim Mitigations and Recommendations

Until official patches are released by Ubuntu, security experts recommend several defensive measures:

  1. Reduce Container Capabilities: Avoid running containers with the --privileged flag. Audit and strictly limit the Linux capabilities assigned to containers using tools like --cap-drop.
  2. Implement Security Profiles: Deploy robust seccomp profiles to restrict the system calls available to containers. This can prevent the specific kernel functions needed to trigger the vulnerability.
  3. Enhance Runtime Monitoring: Use behavioral monitoring tools to detect and block unusual process activities or privilege escalation attempts that match the exploit's pattern.
  4. Apply Live Patches: Where available and feasible, consider applying kernel live patches (like Livepatch) to bridge the gap until a stable update is provided by the vendor.

Organizations are urged to prioritize vulnerability management and verify the patch status of all Ubuntu LTS systems immediately. The combination of a kernel-level flaw, a public exploit, and a missing patch in major LTS distributions creates a high-severity scenario that demands prompt attention.

Linux 核心 AF_UNIX socket 子系統的一項嚴重漏洞現已有公開漏洞利用，對運行未修補 Ubuntu 長期支援（LTS）版本的系統構成容器逃逸至宿主機 root 權限的嚴峻風險。據 The Hacker News 報導，安全公司 DepthFirst 於 9 月 22 日披露了此缺陷，其追蹤編號為 CVE-2026-80521，CVSS 評分為 7.8。

核心問題在於核心內部的一個釋放後使用（use-after-free）記憶體損壞缺陷。具備本地存取權限的攻擊者可利用此缺陷提升權限，並突破容器隔離，最終取得宿主作業系統的完整 root 控制權。由於可用的漏洞利用已被公開，風險顯著提高。

關鍵在於，儘管該漏洞的補丁已於 8 月 6 日合併至 Linux 主線核心，但 Ubuntu 尚未將修補程式回移植至其 26.04、24.04 或 22.04 LTS 版本。此補丁缺口使絕大多數採用 Ubuntu 的伺服器（無論是本地部署還是雲端環境）暴露於攻擊之下。

此情況對於管理容器化工作負載的 DevOps 及站點可靠性工程（SRE）團隊尤為緊急。任何在未修補的 Ubuntu 宿主機上運行不受信任程式碼的容器環境都可能受影響。公開漏洞利用的發佈降低了攻擊者的技術門檻，增加了大規模利用的可能性。

DepthFirst 的研究指出，該缺陷存在於用於進程間通訊的核心組件中。其存在於多個廣泛部署的 LTS 版本，意味著該漏洞可能影響相當大一部分全球 Linux 伺服器生態系統。

臨時緩解措施與建議

在 Ubuntu 發佈官方補丁之前，安全專家建議採取多項防禦措施：

  1. 減少容器權限： 避免使用 --privileged 標誌運行容器。審計並嚴格限制透過 --cap-drop 等工具賦予容器的 Linux 能力。
  2. 實施安全設定檔： 部署強健的 seccomp 設定檔，以限制容器可使用的系統呼叫。這可以阻止觸發漏洞所需的特定核心功能。
  3. 加強運行時監控： 使用行為監控工具，偵測並阻擋符合漏洞利用模式的異常進程活動或權限提升嘗試。
  4. 套用即時補丁： 在可行且適用的情況下，考慮套用核心即時補丁（如 Livepatch），以在供應商提供穩定更新前填補缺口。

強烈敦促各組織優先處理漏洞管理，並立即核查所有 Ubuntu LTS 系統的補丁狀態。核心層級缺陷、公開漏洞利用以及主要 LTS 發行版中缺失補丁的組合，形成了一個高嚴重性情境，需要立即關注。

新聞來源 / Original News Source