Full Report
STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local
Analysis Summary
# Vulnerability: Linux Kernel Traffic-Control Use-After-Free Race
## CVE Details
- **CVE ID:** CVE-2026-53264
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-416 (Use After Free) / CWE-362 (Race Condition)
## Affected Systems
- **Products:** Linux Kernel
- **Versions:** Vulnerable ranges begin with Linux 4.14.
- **Configurations:** Systems are specifically vulnerable if the following kernel options are enabled:
- `CONFIG_NET_ACT_GACT`
- `CONFIG_NET_CLS_FLOWER`
- Unprivileged user namespaces must be enabled for the current exploit to function.
## Vulnerability Description
The flaw exists within the Linux network traffic-control (TC) subsystem's lifecycle handling. A race condition occurs between concurrent `RTM_NEWTFILTER` and `RTM_DELTFILTER` operations. Specifically, one thread can read an action object after another thread has already freed it (Use-After-Free). The logic error resides in how the `clsact` qdisc and `flower` filter handle action objects during updates and deletions.
## Exploitation
- **Status:** PoC available (Full exploit source code published by STAR Labs targeting CentOS Stream 9).
- **Complexity:** Medium (Requires winning a race condition and specific hardcoded ROP offsets for different kernel builds).
- **Attack Vector:** Local (Requires a foothold on the machine; results in Local Privilege Escalation).
## Impact
- **Confidentiality:** High (Full system access)
- **Integrity:** High (Full system access/Root privileges)
- **Availability:** High (Potential for kernel panic/DoS or system takeover)
## Remediation
### Patches
The upstream fix (landed June 1, 2026) defers the free operation until existing Read-Copy-Update (RCU) readers have finished. Fixed versions include:
- 5.10.259
- 5.15.210
- 6.1.176
- 6.6.143
- 6.12.94
- 6.18.36
- 7.0.13
- 7.1-rc7 (Mainline)
### Workarounds
- **Disable Unprivileged User Namespaces:** Setting `user.max_user_namespaces = 0` can mitigate the currently known exploit's ability to gain namespace-local `CAP_NET_ADMIN`.
- **Restricting TC Modules:** Disabling the loading of `cls_flower` and `sch_clsact` modules if not required.
## Detection
- **Indicators of Compromise:** Monitoring for suspicious processes launched by the core-dump handler or unusual modifications to `/proc/sys/kernel/core_pattern`.
- **Detection Methods:**
- **KASAN:** Kernel Address Sanitizer can detect the use-after-free during runtime in test environments.
- **System Auditing:** Audit logs for unusual `RTM_NEWTFILTER` and `RTM_DELTFILTER` netlink messages.
## References
- **Vendor Advisory:** [https://nvd.nist.gov/vuln/detail/CVE-2026-53264]
- **Technical Write-up:** [https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/]
- **Exploit Source:** [https://github.com/star-sg/CVE/tree/master/CVE-2026-53264]
- **Upstream Patch:** [https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux.git/+/5057e1aca011e51ef51498c940ef96f3d3e8a305]