DepthFirst published research and exploit code for a Linux kernel use-after-free in the AF_UNIX socket subsystem, CVE-2026-80521, rated 7.8, that can escape a container and gain root on the host. The flaw sits in the garbage collector for file descriptors passed via SCM_RIGHTS, where a race condition can free linked sockets while a pointer remains on an internal list. AF_UNIX sockets are allowed by default in Docker and Kubernetes seccomp profiles, so the bug is reachable from inside a container. It was fixed upstream on August 6, but Ubuntu has not patched its 26.04, 24.04, or 22.04 LTS releases, including AWS, Azure, and GCP kernels. DepthFirst released a working exploit for 26.04.
Qualys disclosed a privilege escalation flaw in snap-confine, the component that builds the sandbox for every snap application. CVE-2026-8933, rated 7.8, affects default installations of Ubuntu Desktop 24.04, 25.10, and 26.04, and stems from a 2025 hardening change that moved snap-confine from a setuid root binary to a capabilities model, introducing a race during sandbox setup. An attacker mounts a filesystem over the temporary scratch directory, plants a symlink so a privileged write lands on another file, then drops a udev rule that makes a system service run commands as root. Fixes shipped July 21.
Deutsche Telekom's Red Team disclosed CVE-2026-41651, a local privilege escalation in the PackageKit daemon that has shipped in default Linux installations since November 2014. Any unprivileged local user can invoke 'pkcon install' without a polkit prompt, install or remove arbitrary packages, and escalate to root. CVSS 8.8. Confirmed-vulnerable defaults include Ubuntu Desktop and Server LTS, Debian Trixie, Rocky Linux 10.1, and Fedora 43; any RHEL server running Cockpit is also exposed because Cockpit loads PackageKit on demand via D-Bus. PackageKit 1.3.5 fixes it. The researchers credited Anthropic's Claude Opus with helping guide the discovery.
TrustStrike Labs