CVE-2026-80521: Linux Kernel AF_UNIX Use-After-Free Privilege Escalation Fixed in 7.1.10
Do Son 
TL;DR
Google’s kernelCTF program has published full technical details and a working exploit for CVE-2026-80521, a Linux kernel privilege escalation flaw. The bug is a use-after-free in AF_UNIX socket garbage collection, rated CVSS 7.8. Any ordinary local user can trigger it, with no special capabilities or user namespaces required.
A race in the AF_UNIX garbage collector leaves a freed kernel object linked in a cached list. A public exploit turns this into root-level code execution on the kernelCTF LTS 6.12.95 target. Patch to a fixed stable kernel, such as 6.12.111, 6.18.53 or 7.1.10.
- CVE: CVE-2026-80521
- CVSS: 7.8 (High · CVSSv3)
- Product: Linux
- Affected: 5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a, de7921631ff323369aa63a4324695ab54ea4047e, 4090fa373f0e763c43610853d2774b5979915959, 6.1.141, 6.6.93, 6.10
- Impact: af_unix: Unlink scc_entry in unix_del_edge().
- Status: No confirmed exploitation yet
- Patched in: 2b6c2842692d08e7acaf32d1eb47f95def35f3fe, 6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33, 1293fd69a50d188a5788b08ba3741a3e86be1608, fe198b077864feafd4aa4b33b1a5ce26f50195a2 (+8 more)
- EPSS: 0.2% (30-day)
- Action: Update to 2b6c2842692d08e7acaf32d1eb47f95def35f3fe, 6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33, 1293fd69a50d188a5788b08ba3741a3e86be1608, fe198b077864feafd4aa4b33b1a5ce26f50195a2 (+8 more) now
Why It Matters
AF_UNIX sockets are built into almost every Linux system. The only requirement is CONFIG_UNIX, which nearly all distributions enable. According to the write-up, the reproducer “runs as an ordinary user and does not use a user namespace, network namespace, io_uring, BPF, or userfaultfd.” As a result, common hardening steps that disable those features do not block this Linux kernel privilege escalation.
The exploit is also reliable. kernelCTF metadata reports 19 of 20 successful cold boots against the target, with an average run time of about 11 seconds. Now that the CVE-2026-80521 kernelCTF exploit and write-up are public, attackers could adapt it to other kernels. So far, however, no attacks in the wild have been reported, and the flaw is not in CISA’s Known Exploited Vulnerabilities catalog.
How the Attack Works
The root cause
The kernel tracks sockets passed over SCM_RIGHTS as a graph so it can clean up reference cycles. After a full walk, it caches groups of linked sockets in an “scc_entry” ring to speed up the next pass.
The trouble starts in the send path. It publishes new graph edges before queuing the message that carries them. Meanwhile, the garbage collector can run in that gap, judge a group dead and free one of its members. Before the fix, nothing removed that freed vertex from the cached ring. In the CVE record’s words, “GC could free a dead SCC partially.” A surviving socket therefore keeps a pointer to freed memory.
From use-after-free to root
The write-up says the stale pointer gives “a repeatable kmalloc-96 use-after-free.” The exploit chains this into freeing and reclaiming a page of kernel data. From there, it hijacks an existing kernel callback to run a command with full kernel privileges. Notably, it needs no ROP chain and no separate KASLR leak.
Kyle Zeng reported the original bug to the kernel developers.
Affected Versions
- Linux 6.10 through 7.1.9
- Linux 6.1.141 through 6.1.188, and 6.6.93 through 6.6.157, via stable backports
- Kernels older than 6.10 without those backports are not affected
The issue is fixed upstream in Linux 7.2 and in stable releases 7.1.10, 6.18.53, 6.12.111, 6.6.158 and 6.1.189.
Patch and Mitigation
Install your distribution’s kernel update that includes the fix, then reboot. The fix adds a single line that unlinks the vertex from its ring before freeing it. Check your vendor’s advisory for the exact package version.
No clean workaround exists. The researchers warn that “there is no narrow syscall filter that preserves normal AF_UNIX descriptor passing.” Blocking AF_UNIX or SCM_RIGHTS would break many programs. Therefore, patching is the only practical defense against this Linux kernel privilege escalation. Shared hosts, CI runners and container platforms that run untrusted code should update first.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
