STAR Labs has published a Linux kernel exploit demonstrating how an ordinary local user can gain root privileges on the targeted CentOS Stream 9 build by exploiting CVE-2026-53264, a use after free race condition affecting the Linux kernel network traffic control subsystem. The vulnerability carries a CVSS score of 7.8 and enables local privilege escalation rather than remote code execution, meaning an attacker must first obtain access to the targeted system before attempting exploitation. Security researcher Lee Jia Jie stated that artificial intelligence assisted with identifying the vulnerability and accelerating exploit development, although he emphasized that human expertise and decision making remained essential throughout the research process. The exploit source code has now been made publicly available, increasing attention on systems that have not yet received security updates.
According to STAR Labs, the exploit requires several specific conditions before it can be successfully executed. These include unprivileged user namespaces, enabled CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER kernel options, and a kernel specific return oriented programming chain containing hardcoded offsets. These technical requirements reduce the number of immediately affected systems, but researchers noted that public availability of exploit code increases the importance of applying security patches. The upstream Linux kernel fix was released on June 1, 2026, and has since been backported to several supported kernel branches. Vulnerable versions begin with Linux 4.14, while patched releases include versions 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13, with the mainline correction entering version 7.1 rc7. Researchers advised Linux users to install updated kernels provided by their operating system distributors instead of relying solely on upstream version numbers. As of July 28, 2026, the vulnerability had not been added to CISA’s Known Exploited Vulnerabilities catalog, and there were no confirmed reports indicating exploitation in real world attacks.
Lee explained that artificial intelligence contributed to several stages of the research process, including vulnerability discovery, generation of a Kernel Address Sanitizer proof of concept, and optimization of the race condition required for successful exploitation. However, STAR Labs did not disclose the specific AI model, prompts, service, or interaction history used during the research, making it difficult for independent researchers to evaluate the extent of AI involvement or compare the results with other AI assisted security research. Lee acknowledged that artificial intelligence continues to have limitations in reasoning and problem solving, stating that human judgment remained necessary throughout the project. The Hacker News reported that it contacted STAR Labs requesting additional information regarding the AI system, testing environment, and vulnerability disclosure timeline, with updates expected if further details become available.
The vulnerability exists in the lifecycle management of Linux traffic control actions, where concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can result in one process accessing an object after it has already been released by another process. The Linux kernel patch resolves the issue by delaying object deallocation until all existing read copy update readers have completed their operations. The published exploit creates separate user and network namespaces, allowing namespace local CAP_NET_ADMIN privileges without requiring administrator rights on the host system. It accesses the vulnerable code path using a clsact queue discipline and flower filter, while timerfd and epoll operations expand the race window before reclaiming the freed object. The return oriented programming chain then overwrites the core_pattern setting, places a copy of the exploit inside a memfd, and intentionally crashes a child process so Linux executes the memory backed binary as the root core dump handler within the initial namespace. Lee reported successful exploitation in all ten of his tests on CentOS Stream 9, with execution times ranging from nine to 111 seconds, although those results have not been independently verified. Security tracking pages also show varying patch availability across Linux distributions, with Debian listing fixed kernels for supported releases, Ubuntu continuing to mark several maintained kernel packages as vulnerable, and SUSE reporting the issue as pending across multiple products while assigning a lower severity score of 5.5 based on its own assessment.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
