STAR Labs Turned a Race Condition in Linux's Traffic-Control Subsystem Into a Root Exploit With the Help of AI

STAR Labs has published an exploit for the Linux kernel that turns an ordinary local user into root on a CentOS Stream 9 build. The vulnerability was assigned the identifier CVE-2026-53264 (CVSS 7.8) and is a use-after-free race condition in the network traffic management (traffic-control) subsystem.

Researcher Li Jia Jie recounted how artificial intelligence helped him discover the bug, prepare a PoC based on Kernel Address Sanitizer (KASAN), and optimize the race window. At the same time, he himself stresses that AI still has “plenty of blind spots and gaps in its reasoning,” and that human judgment remained necessary at every stage. In his words, because of the heavy use of AI, hunting for even new bugs felt like “n-day analysis.”

What Exactly Is Vulnerable

The bug lies in how the lifecycle of traffic-control actions is handled. Concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can cause one thread to read an action object after another thread has already freed it. The official patch defers the freeing of the memory until all RCU readers have finished.

This is a local privilege escalation, not remote code execution: an attacker first needs access to the machine. The proof-of-concept exploit also requires unprivileged user namespaces, the kernel options CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER, and a ROP chain with offsets hard-coded for a specific kernel. The exploit creates its own user and network namespaces, obtaining local CAP_NET_ADMIN, reaches the vulnerable path via the clsact qdisc and a flower filter, and then overwrites core_pattern to launch its own copy from a memfd as the core-dump handler with root privileges.

Scope of the Risk and the Patches

According to the author, the exploit worked in all 10 runs, taking between 9 and 111 seconds on a CentOS Stream 9 laptop — but these figures have not been independently reproduced. Because of the fixed offsets, the code must be rebuilt for other kernel builds, and it may not work on newer versions.

The fix landed in upstream on June 1, 2026, and was backported to the stable branches: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13; in mainline it landed in 7.1-rc7. Versions starting from Linux 4.14 are listed as vulnerable. As of July 28, the status across distributions is uneven: Debian has already released fixed kernels, Ubuntu still flags a number of packages as vulnerable, and SUSE is keeping the matter at a pending status and rates the risk at 5.5 points. There is no entry for the CVE in the CISA KEV catalog, and no cases of exploitation in real-world attacks have been recorded.

The upstream patch is credited to Kyle Zeng (KyleBot), who reported the bug shortly before the TyphoonPwn 2026 competition. Li claims he found the same bug independently and later published a technical write-up and exploit code. Users are advised to install the fixed kernel from their distribution rather than to rely on the upstream version number alone.

Source: The Hacker News