container_escape_audit.sh v4.8.1 — now detecting the DepthFirst container escapes. Following DepthFirst's…

Liam R. — Freelance Penetration Tester

2026-09-24

container_escape_audit.sh v4.8.1 — now detecting the DepthFirst container escapes.

Following DepthFirst's "Containers Are No Longer a Security Boundary" disclosure (Sept 22), the read-only container-escape/LPE auditor now covers both kernel bugs from it:

CVE-2026-80521 — an AF_UNIX garbage-collector use-after-free that lets an unprivileged process in a default Docker/Kubernetes container escape to root on the host. There's a public exploit, and Ubuntu 22.04/24.04/26.04 (including AWS/Azure/GCP kernels) were still unpatched at disclosure. It's reachable through ordinary AF_UNIX operations that seccomp and namespaces don't block — so it's the kind of thing "we run non-root, we're fine" doesn't save you from.

CVE-2026-52910 — the sibling reuseport cBPF RCU use-after-free from the same disclosure.

CVE database is now 53 entries; the tool stays strictly read-only (no writes, no exploitation) and version-checks with distro-aware, defer-to-vendor verdicts rather than naive kernel comparisons. Number of checks in the script has increased to 60.

github.com/liamromanis101/K8s-container_escape_audit

#ContainerSecurity #Kubernetes #LinuxSecurity #CVE #DevSecOps

4 reactions · 0 comments

Topics: #devsecops, #kubernetes, #cve, #containersecurity, #linuxsecurity

Read and join the discussion on Cyberr