[ubuntu]

September 24, 2026

• Public exploit for an unpatched Ubuntu container escape. CVE-2026-80521 (CVSS 7.8) is a use-after-free in the Linux kernel's AF_UNIX socket garbage collector: a race lets the collector free linked sockets while leaving a dangling pointer that the next pass follows into freed memory. It was fixed upstream on 6 August (mainline 7.2, stable 7.1.10), but Ubuntu has not shipped patches for 26.04, 24.04 or 22.04 LTS, including the cloud-optimised AWS/Azure/GCP kernels. AF_UNIX is permitted by default in Docker and Kubernetes seccomp profiles, so the path is reachable with ordinary syscalls from inside a container; DepthFirst published a working exploit targeting Ubuntu 26.04 on 22 September. No confirmed in-the-wild exploitation, and it is not in KEV (The Hacker News). · Vulnerabilities & Exploits

in The Exploit Is Public, the Ubuntu Patch Isn't

June 29, 2026

• CVE-2026-46331 ("pedit COW") — a Linux kernel privilege-escalation flaw in the net/sched act_pedit traffic-control subsystem (CVSS 7.8) — now has a public PoC (packet_edit_meme, by researcher Massimiliano Oldani). The bug is an out-of-bounds write from incorrect Copy-on-Write handling that lets an unprivileged local user poison the page cache and modify cached privileged binaries in memory to reach root, complicating on-disk detection. Patched kernels are shipping from Red Hat, Ubuntu, AlmaLinux and CloudLinux; defenders should watch for unusual tc/unshare use and restrict unprivileged user namespaces where feasible. (Daily Dark Web, Dark Web Informer) · Vulnerabilities & Exploits

in Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week