AI-Assisted Exploit Turns Linux Traffic-Control Race Condition Into Root Privilege Escalation

STAR Labs researcher Lee Jia Jie has published a Linux kernel exploit that leverages artificial intelligence to discover and weaponize a use-after-free race condition in the kernel’s network traffic-control subsystem, tracked as CVE-2026-53264 (CVSS 7.8). The flaw allows a local user to escalate privileges to root on CentOS Stream 9, though it requires unprivileged user namespaces, specific kernel options (CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER), and a kernel-specific ROP chain. The upstream fix was committed on June 1, 2026, and backported to multiple stable branches including 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13.

The vulnerability arises from concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations, where one thread reads an action object after another frees it. The patch defers the free operation until RCU readers complete. Lee’s exploit creates user and network namespaces, uses clsact qdisc and flower filter, and employs timerfd/epoll to widen the race window. The ROP chain overwrites core_pattern, causing a child process crash to execute a memfd-backed binary as root. Lee reported 100% success in 10 test runs, taking 9–111 seconds.

Lee stated that AI assisted with vulnerability discovery, KASAN proof-of-concept generation, and race window optimization, though he noted AI still has blind spots and required human judgment. The exploit code is public, but practical risk is limited by the specific prerequisites. As of July 28, 2026, CISA’s Known Exploited Vulnerabilities catalog has no entry, and no in-the-wild exploitation has been reported. Distribution patch status varies: Debian has fixes, Ubuntu lists multiple kernels as vulnerable, and SUSE rates the flaw at 5.5 (availability-only impact).