Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN943
_____________________________________________________________________

DATE                : 28/09/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Ubuntu linux versions 26.04 LTS, 24.04 LTS.
  
=====================================================================
https://www.thaicert.or.th/en/2026/09/24/linux-kernel-vulnerability-on-ubuntu-could-allow-container-escape-after-exploit-code-is-released/
https://ubuntu.com/security/CVE-2026-80521
_____________________________________________________________________

Researchers from DepthFirst have disclosed technical details and
exploit code for CVE-2026-80521, a Linux Kernel vulnerability with a
CVSS score of 7.8. The flaw is a use-after-free vulnerability in the
AF_UNIX subsystem. The published exploit was tested against Ubuntu
26.04 LTS and can be used from within a container to escape its
isolation boundary and gain root privileges on the host system.
Ubuntu has stated that kernels used by Ubuntu 26.04 and 24.04 are
affected and that fixes are still being prepared.

The vulnerability is caused by a race condition in the AF_UNIX garbage
collection process when handling file descriptors passed through
SCM_RIGHTS, which may cause the kernel to access memory that has
already been freed. Because containers share the host system’s
kernel, an attacker who can execute code inside a container may
exploit the flaw to escalate privileges and gain access to the host.
The upstream Linux Kernel project released a patch on August 6, 2026.
However, at the time the exploit was publicly disclosed, Ubuntu had
not yet released patches for some affected kernel versions.

Administrators using Ubuntu should check their deployed kernels
against the Ubuntu Security Tracker, as the impact varies depending
on the Ubuntu release and kernel version in use. Ubuntu 26.04 LTS
and 24.04 LTS still have affected kernels, while the main kernel
used by Ubuntu 22.04 LTS is not affected. However, some HWE and
cloud kernel variants for Ubuntu 22.04 remain listed as vulnerable.
For systems where a patch is not yet available, administrators
should consider using workloads with stronger kernel isolation
from the host, such as Firecracker or Kata Containers, particularly
for untrusted workloads, to reduce the risk of container escape
while awaiting security updates.

Source: https://thehackernews.com/2026/09/exploit-released-for-unpatched-ubuntu.html

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================