DepthFirst's AF_UNIX exploit takes host root out of a default-configured Ubuntu container

The AF_UNIX garbage collector reclaims file descriptors that processes pass to each other in SCM_RIGHTS messages ^[8]. DepthFirst describes a race in that collector: it can see new references before the data carrying them has been queued, free part of a linked group of sockets, and leave a pointer to the freed memory on a persistent internal list ^[10]. The next collection pass follows that pointer ^[10]. Every step uses syscalls a default container is permitted to make, and AF_UNIX is allowed by default in both Docker and Kubernetes seccomp profiles ^[9]. Namespace isolation, cgroup limits and seccomp filtering do not stop it ^[11].

DepthFirst won a Google kernelCTF slot with the exploit on July 24 and reported the bug to the kernel security team on August 5 ^[17]. The fix landed upstream the next day, in mainline kernel 7.2 and stable branch 7.1.10 ^[12][2]. The research and the exploit went out on September 22, 47 days after that commit, with Ubuntu's tracker still marking the 26.04 kernel "vulnerable, work in progress" ^[5][1] and no date published for the distribution update ^[14].

The firm credits its own model, dfs-large1, trained for vulnerability detection, working alongside a human-operated test harness ^[16]. Kernel maintainers replied that a researcher at OpenAI had independently reported the same bug, according to DepthFirst's timeline ^[18]. The CVE commit credits kernel-exploitation researcher Kyle Zeng as the reporter ^[19].

The exposure extends past Ubuntu. The vulnerable code entered the kernel at 6.10 and was backported to the 6.1 and 6.6 stable branches ^[13], so any distribution shipping those branches without the August patch is in the same position. Ubuntu is the one with public exploit code written against it ^[4]. Operators running an affected kernel can apply the upstream patch directly ^[14].

DepthFirst's assessment goes beyond this one bug. The firm argues organizations should stop treating containers as a security boundary ^[21]. "The barrier to escaping containers by attacking the kernel has fallen so significantly that we must assume attackers can do so at will," the company said ^[22]. Its supporting number is volume: LinuxCVETracker counts nearly 5,700 Linux kernel CVEs published in 2026, the highest annual total on record ^[23]. Across the 265 days to September 22 that is roughly 21 a day ^[3]. Two other container escapes this year, a futex bug disclosed in July and a flaw in the kernel's cryptographic subsystem in April, also came out of AI-assisted research ^[20].