Public CVE-2026-53264 Exploit Elevates Local Linux Users to Root

On July 28, 2026, STAR Labs published exploit code for CVE-2026-53264, a Linux kernel use-after-free race with a CVSS score of 7.8. The CentOS Stream 9 demonstration elevated an ordinary local user to root through the network traffic-control subsystem.

Why the vulnerability requires attention

This is local privilege escalation rather than remote code execution: an attacker must already have access to the host. Exploitation also requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER options, and a kernel-specific ROP chain with hardcoded offsets.

These constraints limit immediate exposure, but public source code reduces the effort required to test and adapt the technique. Vulnerable ranges begin with Linux 4.14, while the actual risk depends on each distribution's kernel package and configuration.

Exploit mechanics and fixed releases

Concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one thread reading a traffic-control action after another has freed it. The patch defers that free operation until existing read-copy-update readers have completed.

• The upstream fix landed on June 1, 2026.
• Fixed releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13.
• The mainline correction entered Linux 7.1-rc7.
• No confirmed exploitation in the wild had been reported by July 28.

Researcher Lee Jia Jie said AI assisted with discovery, a Kernel Address Sanitizer proof of concept, and optimisation of the race window. His exploit succeeded in all 10 tests on a CentOS Stream 9 laptop, taking between nine and 111 seconds, although the results have not been independently reproduced.

“AI still has many blind spots and lapses in reasoning ability.”

For businesses, the practical response is to inventory exposed Linux hosts, verify namespace and kernel-option settings, and install distribution-supplied patched kernels. Debian reported fixes for supported stable releases, while several Ubuntu and SUSE packages remained vulnerable or pending on July 28.