CVE-2026-80521: Linux Kernel AF_UNIX Use-After-Free Privilege Escalation Vulnerability Exploited Locally
CVE-2026-80521 is a use-after-free vulnerability in the Linux kernel's AF_UNIX socket garbage collection subsystem, rated CVSS 7.8 (High). It allows any local unprivileged user to escalate privileges to root without special capabilities or namespaces. The flaw stems from a race condition where a freed kernel object remains linked in a cached list, leading to a kmalloc-96 use-after-free. A reliable public exploit by Google's kernelCTF program achieves root code execution on affected kernel versions (6.1.141 through 6.1.188, and 6.6.93 through 6.6.157, among others). No confirmed active exploitation has been reported, and it is not yet included in the CISA KEV catalog. The issue is fixed in Linux 7.1.10, 6.18.53, 6.12.111, and later stable releases. The patch unlinks the freed object from its ring before freeing it. There is no practical mitigation other than patching, as disabling AF_UNIX or SCM_RIGHTS would break many applications. It is recommended that all affected systems, especially shared hosts and container platforms running untrusted code, apply the update and reboot immediately.
Entenda a falha
A vulnerabilidade
CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket garbage collector (CVSS 7.8, High). Any local unprivileged user can trigger it, with no special capabilities and no user, network or other namespaces, and gets root code execution. It needs only CONFIG_UNIX, which nearly all distributions enable. The article lists 6.1.141 through 6.1.188 and 6.6.93 through 6.6.157 (stable backports) as affected, and kernels older than 6.10 without those backports as not affected. The story also lists 6.12, 6.18 and 7.1, and the public exploit targets 6.12.95. Fixed in 7.2 upstream and in stable 7.1.10, 6.18.53, 6.12.111, 6.6.158 and 6.1.189.
Como funciona
The kernel tracks sockets passed between processes over SCM_RIGHTS as a graph, so it can clean up reference cycles. After a full walk, the garbage collector caches groups of linked sockets in an scc_entry ring to speed up the next pass. The send path publishes new graph edges before it queues the message that carries them. In that gap the garbage collector can run, judge a group dead and free one of its members. The freed vertex is still linked in the cached ring, so a surviving socket keeps a pointer to freed memory, a kmalloc-96 use-after-free.
Por que é vulnerável
It is a race condition combined with missing cleanup. The garbage collector could free a dead group of sockets only partially, in the CVE record's words, and nothing removed the freed vertex from the cached scc_entry ring. The stale entry therefore stayed reachable. The fix adds a single line that unlinks the vertex from its ring in unix_del_edge() before it is freed.
Onde está
The flaw is in the AF_UNIX garbage collection code, where unix_del_edge() must unlink the scc_entry before freeing the vertex; the fix commit titled "af_unix: Unlink scc_entry in unix_del_edge()" is among the commits the article lists.
Como foi descoberta
According to the article, Kyle Zeng reported the original bug to the kernel developers. Google's kernelCTF program then published full technical details and a working exploit for it. The articles do not say how or when the bug was first found. No attacks in the wild have been reported and the flaw is not in CISA's KEV catalog.
PoC pública
Google's kernelCTF published a write-up and a working exploit that turns the use-after-free into root code execution on the kernelCTF LTS 6.12.95 target. It runs as an ordinary user without namespaces, io_uring, BPF or userfaultfd. It is reliable: kernelCTF metadata reports 19 of 20 successful cold boots, averaging about 11 seconds. Since it is public, attackers could adapt it to other kernels, so patch and reboot quickly, shared hosts, CI runners and container platforms first.
Publicada em: securityonline.info/cve-2026-80521-linux-kernel-privilege-escalation/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 05:15.
Linha do tempo
-
CVE-2026-80521: Linux Kernel AF_UNIX Use-After-Free Privilege Escalation Vulnerability Exploited Locally
ler a análise desta fonte ocultar
CVE-2026-80521 is a use-after-free vulnerability in the Linux kernel's AF_UNIX socket garbage collection subsystem, rated CVSS 7.8 (High). It allows any local unprivileged user to escalate privileges to root without special capabilities or namespaces. The flaw stems from a race condition where a freed kernel object remains linked in a cached list, leading to a kmalloc-96 use-after-free. A reliable public exploit by Google's kernelCTF program achieves root code execution on affected kernel versions (6.1.141 through 6.1.188, and 6.6.93 through 6.6.157, among others). No confirmed active exploitation has been reported, and it is not yet included in the CISA KEV catalog. The issue is fixed in Linux 7.1.10, 6.18.53, 6.12.111, and later stable releases. The patch unlinks the freed object from its ring before freeing it. There is no practical mitigation other than patching, as disabling AF_UNIX or SCM_RIGHTS would break many applications. It is recommended that all affected systems, especially shared hosts and container platforms running untrusted code, apply the update and reboot immediately.