{"vulnerability": "CVE-2026-80521", "sightings": [{"uuid": "b89afa29-4587-4831-8ff0-908f9bda5081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117164986929423742", "content": "There is a new vulnerability with elevated criticality in Linux Kernel (CVE-2026-80521) https://vuldb.com/vuln/395816", "creation_timestamp": "2026-08-27T01:57:01.462304Z"}, {"uuid": "973273f8-8ade-4c8a-a1be-5577cbe64983", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mw6rfhbhe624", "content": "A Linux AF_UNIX use-after-free lets attackers escape containers and obtain host root via CVE-2026-80521, with Ubuntu LTS releases lacking the upstream fix.\n", "creation_timestamp": "2026-09-23T12:44:11.030654Z"}, {"uuid": "decaea7a-04fd-4533-8143-72c6475f1cdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mw6rfit66g2m", "content": "A Linux AF_UNIX use-after-free lets attackers escape containers and obtain host root via CVE-2026-80521, with Ubuntu LTS releases lacking the upstream fix.\n", "creation_timestamp": "2026-09-23T12:44:12.597133Z"}, {"uuid": "9eddb749-bdf2-4a22-a16f-b1c852f329b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-80521", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mw6rxm7cwk2l", "content": "Exploit released for unpatched Ubuntu kernel flaw that lets containers root the host (CVE-2026-80521)\n\nCVE-2026-80521 is a Linux kernel AF_UNIX use-after-free that enables container escape to host root. Ubuntu 22.04,\u2026\n\nhttps://thecybersecguru.com/news/cve-2026-80521-ubuntu-kernel-container-escape/", "creation_timestamp": "2026-09-23T12:54:18.461003Z"}, {"uuid": "cb0811b4-44d8-43a5-ae61-6f05dc3e5f71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mw6str2zxa2q", "content": "Public Exploit for CVE-2026-80521 Puts Ubuntu Containers at Root Risk", "creation_timestamp": "2026-09-23T13:10:05.139360Z"}, {"uuid": "90059cc2-8867-42c0-88f6-ffe22d02056d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://bsky.app/profile/robcampbell.bsky.social/post/3mw6z5ftbok2r", "content": "Public exploit code for CVE-2026-80521 escapes Ubuntu 26.04 containers to root on the host. Fixed upstream in August, but Ubuntu still lists 26.04 as vulnerable.\n\nAgain, Ubuntu is behind on security.\n\ndepthfirst.com/research/con...\n\n#Linux #Ubuntu #Security", "creation_timestamp": "2026-09-23T15:02:49.973020Z"}, {"uuid": "8c7c9407-8ccc-44c0-82b2-4e09a6d37e1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-80521", "type": "seen", "source": "https://infosec.exchange/ap/users/116810780845358081/statuses/117320467615517835", "content": "\ud83d\udea8 **CVE-2026-80521: Linux kernel container escape**\nA public exploit chains an **AF_UNIX socket garbage-collector use-after-free** into host-level code execution from an unprivileged container.\nThe bug involves a race in the SCC garbage collector that leaves a freed `unix_vertex` reachable through a stale `scc_entry` pointer.\nThe PoC reportedly works against Ubuntu 26.04 and defeats several kernel hardening mechanisms.\nUbuntu 22.04, 24.04 and 26.04 are currently listed as affected in the article's September 23 update.\nTechnical breakdown + exploit chain:https://thecybersecguru.com/news/cve-2026-80521-ubuntu-kernel-container-escape/\n#Linux #Cybersecurity #ContainerSecurity #Docker #Kubernetes #CVE", "creation_timestamp": "2026-09-23T15:02:56.514916Z"}, {"uuid": "d1189261-d14c-4201-9cad-02e92556a17e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html", "content": "A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22.\n\nThe flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. DepthFirst ", "creation_timestamp": "2026-09-23T16:00:43.390500Z"}, {"uuid": "0bea9e1b-bf89-4a99-8bc8-a1b3dec80206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://gist.github.com/ichintu/2e6f8ce728dea0dd9cf4a6348df184a8", "content": "**September 22\u201323, 2026 Cyber Threat Intelligence Summary**\n\n**\ud83d\udd34 Critical Vulnerabilities & Patches**\nUrgent updates required for **WordPress** (AV26-952) and **SolarWinds** (AV26-950) due to actively exploited, unauthenticated RCEs. **HPE** (AV26-951) patches DoS and multiple flaws in ALE and Telco Orchestrator. Other notable advisories include a cPanel root-escalation bug, ManageEngine SQLi (CVE-2026-14913), Tauri v2 CSP bypass (CVE-2026-95626), Chrome 154 (108 patches, 11 critical), and an unpatched Ubuntu kernel flaw (CVE-2026-80521) enabling container escape to host root.\n\n**\ud83e\udda0 Emerging Threats & Malware**\n- **CLOSEDQUORUM:** Windows malware using AI model voting for C2 to steal credentials and crypto wallets.\n- **MemTensor Compromise:** Legitimate npm/PyPI packages hijacked to distribute the cross-platform `sckit` credential stealer.\n- **Android MDM Spyware:** Targeting logistics companies via corporate mobile device management systems.\n\n**\ud83d\udd17 Supply Chain & Operational Risks**\n- **GitHub App Keys:** Private keys never expire, creating persistent takeover risks. GitGuardian identified 474 active leaked keys, many with admin/write privileges.\n- **MSP Relationships:** Heavily trust-based MSP contracts are flagged as a major supply chain vector. Experts recommend enforcing dedicated admin accounts, phishing-resistant MFA, full audit logging, and strict offboarding/breach protocols.\n\n**\ud83d\udcf1 Platform Updates**\n- **Android 17:** Enables Certificate Transparency, which will break trust in custom/internal CAs and require PKI adjustments.\n\n**\u2705 Key Actions:** Immediately patch affected software, revoke unused GitHub App keys, audit MSP security controls, and prepare for Android 17 CA changes.", "creation_timestamp": "2026-09-23T16:01:57.040262Z"}, {"uuid": "566d541d-8754-421b-b7f0-4b15d992ad7d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mw7t2oioj22s", "content": "Okay. Your container's AF_UNIX trash collector freelances into host root now. CVE-2026-80521, public exploit for Ubuntu 26.04, Canonical still 'work in progress' six weeks after upstream patched. Morty, the box was never the prison. day267.008", "creation_timestamp": "2026-09-23T22:46:37.770686Z"}, {"uuid": "2e7389b5-e957-4704-81fc-457b8939ecbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-80521", "type": "seen", "source": "Telegram/S-eanWOUhUrwtpdMLNsdmMvih-Ej2z3EU8EwvlHu_0cVQg", "content": "", "creation_timestamp": "2026-09-23T16:06:46.000000Z"}]}