Linux Kernel Flaw CVE-2026-53264 Lets Local Users Execute Arbitrary Code, PoC Published

TL;DR

A new Linux kernel vulnerability, tracked as CVE-2026-53264, lets a local user run arbitrary code and escalate to root. The flaw sits in the net/sched packet scheduler and comes from a use-after-free race. Star Labs has now published full technical details and a working proof-of-concept.

Why this Linux kernel vulnerability matters

Root access is the real prize here. An unprivileged user can trigger the bug and take full control of the machine. That risk climbs on desktops, where the required features often ship enabled by default.

Researcher Lee Jia Jie found the issue while hunting zero-days for TyphoonPwn 2026. Notably, AI tooling helped speed up discovery and testing, as Star Labs explains in its write-up on AI-assisted bug hunting.

How the attack works

The core issue is a locking mismatch. The kernel looks up a shared traffic-control action under an RCU read lock. However, another path can free that same action without waiting for the RCU grace period.

As a result, a freed object can be reclaimed and reused before its reference count is checked. Attackers race filter creation against filter deletion to open this narrow window. Then they reclaim the memory and corrupt kernel state.

Exploitation status

A public proof-of-concept now lives in the Star Labs CVE-2026-53264 repository. So far, no in-the-wild exploitation has been confirmed. Star Labs tested the exploit on CentOS Stream 9 Desktop and reached root in seconds during optimized runs.

Affected versions

The bug affects Linux kernels that manage net/sched actions with the vulnerable locking pattern. Exploitation also needs unprivileged user namespaces, plus clsact qdiscs and flower classifiers. Red Hat rates the flaw 7.0, while other trackers list it at 7.8.

Patch and mitigation

Maintainers have fixed this Linux kernel vulnerability upstream. The patch defers freeing until after the RCU grace period, which closes the race window. Therefore, admins should move to a patched kernel now.

Cannot patch yet? Disable unprivileged user namespaces where your workloads allow it. Also watch for unusual netlink activity and unexpected changes to core_pattern.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.