Google’s kernelCTF program published technical details and a working exploit for CVE-2026-80521, a Linux kernel use-after-free in AF_UNIX garbage collection that gives a local user root access. The flaw carries a CVSS score of 7.8, and the write-up appeared on November 11 and 12.
The AF_UNIX Garbage Collection Race
CVE-2026-80521 is a local privilege escalation flaw. A race condition in the AF_UNIX garbage collector leaves a freed object in a cached list, creating the use-after-free. Securityonline reported the details from the kernelCTF publication.
Why Common Hardening Does Not Block It
Any ordinary local user can trigger the bug. The exploit needs no user namespaces, network namespaces, io_uring, BPF or userfaultfd. Because those features are the ones administrators often restrict to limit kernel attack surface, standard hardening measures do not stop this exploit.
Reliability Figures From the kernelCTF Exploit on 6.12.95
The published exploit succeeded in 19 of 20 cold boots on kernelCTF LTS 6.12.95. Each successful run took about 11 seconds on average. Those numbers describe a reliable path to root on an unpatched kernel of that version.
Fixed Kernel Versions Including 6.12.111 and 7.1.10
The fix appears in stable kernel releases, including 6.12.111, 6.18.53 and 7.1.10. Systems running kernels older than the fixed release in their branch remain exposed.
No Attacks Reported and No KEV Listing
No in-the-wild attacks have been reported, and the flaw does not appear in CISA’s Known Exploited Vulnerabilities catalog. A public working exploit changes the risk picture for local attackers, though the report does not link the exploit to any campaign.
What a Local-Only Flaw Means in Practice
The vulnerability requires local access, so a remote attacker would need a foothold on the machine first. The report describes the impact as reliable root for local attackers on unpatched kernels. That makes the bug relevant in settings where multiple users share a machine or where an attacker has already compromised a low-privilege account.
Disclosure Through Google’s kernelCTF Program
The details came from Google’s kernelCTF program, which publishes technical write-ups and exploits for kernel flaws. The release of both the explanation and the working exploit means that anyone can reproduce the privilege escalation on affected systems. The sources do not say how long the stable-kernel fixes have been available relative to the publication.
The reporting rests on a single Securityonline article. It supplies the exploit’s success rate and timing, which kernelCTF measured on its own LTS 6.12.95 test kernel, and results on other kernels or configurations may differ. The published fixed versions give administrators three reference points for the 6.12, 6.18 and 7.1 stable lines.
Because the exploit avoids features that hardening guides commonly disable, the flaw reaches systems that would otherwise resist similar bugs. The report treats patching to a fixed stable kernel as the remedy.
Sources and Reporting Notes on the kernelCTF Disclosure
Securityonline reported the write-up and exploit after Google’s kernelCTF program published them on November 11 and 12. The report gives the CVSS 7.8 rating, the three fixed stable kernel versions and the 19-of-20 success rate on kernelCTF LTS 6.12.95. No attacks have been reported, and CISA has not listed the flaw in its Known Exploited Vulnerabilities catalog.
The numbers describe a fast and dependable exploit. At about 11 seconds on average and 19 successes across 20 cold boots, the technique does not rely on timing luck in the way many race-condition exploits do. The report attributes that reliability to the exploit’s design rather than to any special configuration of the test kernel.
Because the target is the AF_UNIX garbage collector rather than an optional kernel feature, the vulnerable code is present on ordinary Linux systems.
