The flaw, tracked as CVE-2026-53264, affects the kernel’s net/sched component and carries a severity score of 7.8. It is a use-after-free vulnerability that can allow an ordinary user with access to a vulnerable machine to gain the highest level of system privileges.
Lee Jia Jie of Singapore-based STAR Labs published the technical analysis and exploit code on July 27. He said artificial intelligence assisted with locating the bug, creating an initial Kernel Address Sanitizer proof of concept and improving the timing needed to win the race condition.
The vulnerability does not allow an attacker to compromise a system remotely without prior access. A malicious actor would first need a local account, a foothold obtained through another vulnerability or the ability to run code on the target machine.
Its practical exploitation also depends on several system conditions. Unprivileged user namespaces must be enabled, while the kernel requires configuration options supporting the generic action and flower traffic classifier modules. The published exploit additionally contains return-oriented programming offsets tailored to a particular CentOS Stream 9 kernel build.
Those requirements narrow the immediate risk, but public availability of working exploit code increases pressure on administrators to update affected systems. Attackers can study the techniques, adapt the code to other kernel builds and combine the vulnerability with separate weaknesses that provide initial access.
The bug lies in the management of traffic-control action objects. Linux uses the net/sched subsystem to determine when network packets are transmitted, the order in which they are processed and the actions applied to packets matching specified rules.
Concurrent operations can cause one processor thread to look up an action object while another deletes and frees it. The first thread may then continue using memory that has already been released, creating an opportunity for an attacker to reclaim and manipulate the same memory location.
The exploit reaches the vulnerable code through netlink operations involving clsact queueing disciplines and flower filters. It creates separate user and network namespaces, obtaining network-administration capabilities within the isolated namespace without securing administrator privileges on the host.
Multiple threads are then used to enlarge the race window. Timer and event-polling operations slow selected execution paths, while specially prepared key payload allocations attempt to occupy the memory previously used by the deleted traffic-control object.
Once the freed object is successfully reclaimed, the exploit redirects kernel execution through a return-oriented programming chain. It overwrites the kernel’s core_pattern setting, which defines how Linux handles crashed processes and where core dumps are sent.
The demonstration copies the exploit into an anonymous memory-backed file and deliberately crashes a child process. Linux subsequently launches the altered core-dump handler with root privileges, allowing the attacker-controlled program to execute in the initial namespace.
Lee reported that the exploit succeeded in 10 consecutive tests on a laptop running CentOS Stream 9. Execution times ranged from nine seconds to 111 seconds. The reliability figures were produced in the researcher’s own environment and may vary across processors, kernel packages and system configurations.
The use of hardcoded programming-gadget offsets also means the published code cannot be expected to work unchanged across distributions. Adapting it to other kernels would require technical knowledge and suitable instruction sequences within each target build.
The underlying defect had existed for roughly two to three years. Kyle Zeng, also known as KyleBot, reported it to kernel maintainers shortly before the TyphoonPwn 2026 hacking competition. Lee said he discovered it independently while preparing an entry and learned later that it had already been reported.
An upstream fix was added on June 1. The patch changes how affected objects are released, delaying memory reclamation until existing read-copy-update readers have finished accessing them.
Corrections have been backported to multiple stable branches. Fixed releases include Linux 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13, with the mainline correction entering the 7.1 development cycle.
Package status varies between distributions because vendors maintain their own kernels and backport security patches without necessarily adopting the upstream version number. Administrators therefore need to check vendor security notices and install the corrected kernel package supplied for their distribution.
No confirmed exploitation in the wild had been publicly documented when the technical details appeared. The vulnerability was also absent from the US Cybersecurity and Infrastructure Security Agency’s catalogue of flaws known to be actively exploited.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
