What is the CVSS score of CVE-2026-80521?

CVE-2026-80521 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2026-80521?

A use-after-free vulnerability in the Linux kernel's Unix domain socket handler (CVE-2026-80521) could allow local users with low system privileges to escalate to root access.. A patch is available.

How to fix or mitigate CVE-2026-80521?

Within 24 hours, identify all Linux systems running affected kernels and prioritize production infrastructure for patching. Within 7 days, deploy the vendor-released patch to non-production systems and conduct staged validation testing. Within 30 days, complete patch deployment across all production Linux systems and validate stability; continue monitoring for exploitation attempts targeting unpatched systems during transition periods.

Linux Kernel CVE-2026-80521

EUVD-2026-66587 HIGH

2026-08-26 Linux

GHSA-g8mr-r59r-2xmq

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition with a reporter-acknowledged small timing window warrants AC:H; PR:L reflects standard unprivileged local socket access required; full kernel impact preserved.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 06:35 vuln.today

CVSS changed

Aug 27, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 26, 2026 - 16:17 EUVD

CVE Published

Aug 26, 2026 - 14:37 cve.org

HIGH 7.8

CVE Published

Aug 26, 2026 - 14:37 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Unlink scc_entry in unix_del_edge().

Kyle Zeng reported that GC could free a dead SCC partially.

The scenario is as follows:

Create two SCCs:

X -. A <-> B ^--'

Run the following concurrently:

2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B

At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail().

If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge.

X -. A <-> B -. This edge is visible ^--' ^..' but skb is not

This itself is not a problem since the next GC run will judge B as dead as well and free it finally.

X -. A <.> B -. ^--' ^--'

However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry.

Let's unlink scc_entry before freeing the vertex in unix_del_edge().

AnalysisAI

Use-after-free race condition in the Linux kernel's AF_UNIX garbage collector (GC) allows a local user with low privileges to corrupt kernel heap memory with potential for privilege escalation. The race occurs between concurrent send() and close() operations on a crafted set of Unix domain sockets forming a Strongly Connected Component (SCC), causing unix_walk_scc_fast() to dereference a freed scc_entry when a partially-freed SCC is walked during the next GC cycle. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain local unprivileged shell

Delivery

Construct Unix socket SCC topology (self-loop X, pair A↔B)

Exploit

Race send(X→B) concurrently with close(A) and close(B)

Install

GC fires in race window, judges A↔B dead, frees vertex without unlinking scc_entry

Next GC invocation walks freed scc_entry via unix_walk_scc_fast()

Execute

Use-after-free corrupts kernel heap

Impact

Escalate privileges to root

Recon

Gain local unprivileged shell

Delivery

Construct Unix socket SCC topology (self-loop X, pair A↔B)

Exploit

Race send(X→B) concurrently with close(A) and close(B)

Install

GC fires in race window, judges A↔B dead, frees vertex without unlinking scc_entry

Next GC invocation walks freed scc_entry via unix_walk_scc_fast()

Execute

Use-after-free corrupts kernel heap

Impact

Escalate privileges to root

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local user account with permission to create AF_UNIX sockets, which is available to unprivileged users by default on virtually all Linux distributions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation by any low-privilege user with no required user interaction, yielding full kernel-level impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a local shell creates a crafted Unix socket topology: a self-looping socket X and an interconnected socket pair A-B forming a second SCC. The attacker then races a send() call from X targeting B against simultaneous close() calls on A and B, aiming to hit the window between unix_add_edges() publishing the B-B edge and skb_queue_tail() completing. …
Remediation	Upgrade to a patched kernel release: Linux 6.1.141 or later for the 6.1 LTS branch, Linux 6.6.93 or later for the 6.6 stable branch, Linux 7.1.10 or later, or Linux 7.2+. … Detailed patch versions, workarounds, and compensating controls in full report.