[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fREfn3-upi8est9fPFa7_Qr9c1IFtZyFvkN8nRtfSbV4":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":111},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b0b9f472-b09a-493d-a64b-fa72dbb95624","Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape","exploit-released-for-unpatched-ubuntu-linux-flaw-enabling-host-root-container-es-a94e39","A use-after-free in the Linux kernel's AF_UNIX socket subsystem can be used to escape a container and gain root on the host, security firm DepthFirst said in research published September 22. The flaw, tracked as CVE-2026-80521 (CVSS score: 7.8), was fixed upstream on August 6, but Ubuntu has not shipped the patch for its 26.04, 24.04, or 22.04 LTS releases. DepthFirst","A critical use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem allows attackers to escape containers and gain root access on the host. While fixed upstream, Ubuntu has not yet released patches for its 26.04, 24.04, and 22.04 LTS releases, leaving them vulnerable. Security firm DepthFirst has released exploit code and recommends using microVM isolation for untrusted workloads.","Exploit released for unpatched Ubuntu Linux kernel flaw enabling container escape.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fexploit-released-for-unpatched-ubuntu.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjZjw_aCdQxMfwTv_-KFLK5KRCd96MoivCQPTAZcAWJal5_84FgCny9Um8csMgDDqta40CUGMPDO14hdbUo9CRk-FMJwY70MsDfV25AC8VmL-8_yDO_UWHYXbmeJ9jZANptIeHqJX9axqzxxn68AHEj8zFhYbh8coIbxWAVC9XbtG9CjxMBpQqclG14QuM\u002Fs1600\u002Flinux.gif","2026-09-23T11:12:18+00:00","2026-09-23T14:00:08.783216+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Ubuntu Linux","product",{"name":21,"type":22},"Ubuntu","vendor",{"name":24,"type":19},"Linux kernel",{"name":26,"type":22},"DepthFirst",{"name":28,"type":29},"Docker","technology",{"name":31,"type":29},"Kubernetes","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"cve","CVE-2026-80521","Unpatched Ubuntu Linux kernel flaw enabling host-root container escape",[21,26,18],{"controls":52,"vendors":110},[53,82],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":83,"name":84,"problem":85,"products":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",[87,95,102],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":83,"product_name":99,"url":100,"description":101},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":112,"title":113,"body":114,"framework_refs":115,"framework_notes":126},"unpatched-ubuntu-kernel-flaw-enables-container-escape-to-host-root","Unpatched Ubuntu Kernel Flaw Enables Container Escape to Host Root","A use-after-free vulnerability in the Linux kernel's AF_UNIX socket subsystem exposes Ubuntu LTS systems (22.04, 24.04, 26.04) to container escape attacks granting host-level root access. Despite an upstream kernel fix being available, Ubuntu has not yet shipped patches to its LTS distributions, creating a dangerous gap between fix availability and deployment. The public release of working exploit code by DepthFirst dramatically lowers the bar for attackers, turning a theoretical risk into an active threat. This incident highlights how the lag between upstream patches and downstream distribution releases can leave large enterprise Linux fleets critically exposed even when a fix technically exists.",[116,117,118,119,120,121,122,123,124,125],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-190: Application Container Security Guide","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","ITIL Change Management: Emergency Change procedures for critical CVEs",{}]