Swati KhandelwalJul 28, 2026Vulnerability / Linux
STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local privilege escalation, not remote code execution, so an attacker needs a foothold on the machine before any of it applies.The demonstrated exploit also requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER kernel options, and a kernel-specific return-oriented programming (ROP) chain containing hardcoded offsets. Those conditions narrow the immediate exposure, but full exploit source code is now public.
The upstream fix landed on June 1, 2026, and has since been backported to several stable kernel branches. The Linux CNA record lists vulnerable ranges beginning with Linux 4.14. Fixed releases are 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13, with the mainline fix entering 7.1-rc7.
Linux users should install a distribution kernel carrying the fix rather than rely on the upstream version number alone. The Hacker News found no entry for the flaw in CISA's Known Exploited Vulnerabilities catalog and no official report of exploitation in the wild as of July 28, 2026.
