Public CVE-2026-53264 Exploit Elevates Local Linux Users to Root
On July 28, 2026, STAR Labs published exploit code for CVE-2026-53264, a Linux kernel use-after-free race with a CVSS score of 7.8. The CentOS Stream 9 demonstration elevated an ordinary local user to root through the network traffic-control subsystem.
Why the vulnerability requires attention
This is local privilege escalation rather than remote code execution: an attacker must already have access to the host. Exploitation also requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER options, and a kernel-specific ROP chain with hardcoded offsets.
These constraints limit immediate exposure, but public source code reduces the effort required to test and adapt the technique. Vulnerable ranges begin with Linux 4.14, while the actual risk depends on each distribution's kernel package and configuration.
Exploit mechanics and fixed releases
Concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one thread reading a traffic-control action after another has freed it. The patch defers that free operation until existing read-copy-update readers have completed.
- The upstream fix landed on June 1, 2026.
- Fixed releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13.
- The mainline correction entered Linux 7.1-rc7.
- No confirmed exploitation in the wild had been reported by July 28.
Researcher Lee Jia Jie said AI assisted with discovery, a Kernel Address Sanitizer proof of concept, and optimisation of the race window. His exploit succeeded in all 10 tests on a CentOS Stream 9 laptop, taking between nine and 111 seconds, although the results have not been independently reproduced.
“AI still has many blind spots and lapses in reasoning ability.”
For businesses, the practical response is to inventory exposed Linux hosts, verify namespace and kernel-option settings, and install distribution-supplied patched kernels. Debian reported fixes for supported stable releases, while several Ubuntu and SUSE packages remained vulnerable or pending on July 28.
CVE-2026-53264: affected versions and PoC checks
A kernel version alone does not determine exposure to CVE-2026-53264. Confirm the distribution package, kernel configuration and local-access conditions before deciding whether a host is affected.
How to determine whether a Linux host is affected
The vulnerable upstream range begins with Linux 4.14, but distributions may backport security fixes without changing to the latest upstream version. Check the distribution advisory and package changelog for the installed kernel rather than relying only on the version string.
- Record the installed kernel and distribution package release.
- Check whether unprivileged user namespaces are enabled.
- Verify CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER settings.
- Confirm whether untrusted users can obtain local access.
- Install the distribution-supplied patched kernel when available.
Fixed upstream releases listed in the report
The reported fixed stable releases are Linux 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13. The mainline correction entered Linux 7.1-rc7. Distribution package status remains the practical reference because vendors can apply backported patches.
What the public PoC does and does not prove
The published proof of concept demonstrated local privilege escalation on CentOS Stream 9. It depended on a kernel-specific ROP chain, hardcoded offsets and a race condition, so successful reproduction on one system does not establish that every Linux installation is exploitable. It also does not turn the issue into remote code execution.
- The attacker must already have local access to the host.
- The demonstrated exploit depends on specific kernel features.
- Public code can reduce the effort needed to test or adapt the technique.
- Test only in an isolated environment with explicit authorisation.
Why the number 70028 is not enough to select a patch
This report concerns CVE-2026-53264. A standalone number such as 70028 is ambiguous and is not established here as an alternative identifier for this vulnerability. Use the complete CVE ID, distribution name and installed package version when checking an advisory or selecting an update.
Frequently asked questions
Which Linux versions are affected by CVE-2026-53264?
The reported vulnerable upstream range begins with Linux 4.14. Actual exposure depends on the distribution package, backported fixes, kernel configuration and whether an attacker can obtain local access.
Is there a public PoC for CVE-2026-53264?
Yes. The reported exploit demonstrated local privilege escalation on CentOS Stream 9, but it uses kernel-specific offsets and required configuration options. It is not a universal exploit or remote code execution.
Is 70028 another identifier for this vulnerability?
No such relationship is established in the supplied report. The relevant identifier is CVE-2026-53264; use the full CVE ID when reviewing vendor advisories and patched packages.
Which fixed kernel version should be installed?
Use the patched kernel package supplied by your Linux distribution. Upstream fixed releases are useful references, but vendors may backport the correction while retaining a different package version.