A serious Linux kernel zero-day vulnerability capable of local privilege escalation (LPE) has been uncovered by security researchers, underscoring both the growing role of artificial intelligence in vulnerability research and the persistent security risks within complex kernel subsystems.
Tracked as CVE-2026-53264, the flaw impacts the Linux kernel’s net/sched packet scheduling subsystem. It stems from a use-after-free (UAF) condition that allows a local attacker to gain root privileges under specific runtime conditions.
AI-Assisted Research Uncovers Linux Kernel Zero-Day
The vulnerability was identified during a transition from analyzing known 1-day flaws to hunting for zero-day vulnerabilities. AI-assisted tooling was utilized to accelerate several phases of the research pipeline, including bug discovery, KASAN proof-of-concept (PoC) generation, and race-condition timing optimization.
While AI significantly improved speed and iteration cycles, manual analysis remained essential—particularly when refining exploitation logic and validating real-world system impact.
According to research published on the Slippy Blog, the core issue stems from a race condition within tcf_idr_check_alloc(), a function responsible for managing shared traffic control actions inside net/sched.
The subsystem controls how packets are queued, filtered, and transmitted across network interfaces.
Specifically, the vulnerable code performs an action lookup under Read-Copy-Update (RCU) read-side protection, while the same object can be freed elsewhere without waiting for an RCU grace period.
This lock mismatch creates a narrow window where a freed action object remains referenced, leading to a usable use-after-free scenario.
The exploit path avoids the restricted RTM_NEWACTION and RTM_DELACTION netlink routes, which require elevated network administration capabilities (CAP_NET_ADMIN) in the initial network namespace.
Instead, it abuses RTM_NEWTFILTER and RTM_DELTFILTER, enabling exploitation from inside an unprivileged user namespace where CAP_NET_ADMIN is locally available.
Consequently, successful exploitation depends on unprivileged user namespaces being enabled on the host system. The researcher combined specific queueing and filter types, including clsact and flower, to bypass locking paths that would otherwise impede winning the race condition.
Similar privilege escalation risks frequently target enterprise environments through unpatched linux kernel flaws.
[Unprivileged Namespace] ──► [RTM_NEWTFILTER / RTM_DELTFILTER] ──► [Race tcf_idr_check_alloc()]
│
[Root Execution] ◄── [Overwrite core_pattern] ◄── [ROP & KASLR Leak] ◄── [UAF via RCU Mismatch]
In testing environments, the exploit was optimized for CentOS Stream 9 desktop configurations and achieved reliable root compromise in repeated runs, occasionally completing in under 10 seconds.
Exploit Execution Components:
- KASLR Bypass: Obtaining a kernel address space layout randomization leak.
- Heap Reclamation: Reclaiming freed memory using
KEYCTL_UPDATEcalls. - Payload Delivery: Constructing a Return-Oriented Programming (ROP) sequence to overwrite
/proc/sys/kernel/core_pattern. - Code Execution: Triggering attacker-controlled binaries with root privileges via core dump execution.
Although the exploit required kernel-specific gadget offsets and precise timing adjustments, the findings confirm that the vulnerability is practical and weaponizable against real Linux desktop targets.
These exploitation mechanics align with tactics seen in other recent local privilege escalation vectors targeting Linux server and desktop distributions.
| Subsystem Component | Vulnerable Code / Function | Primary Remediation Action |
net/sched Subsystem | tcf_idr_check_alloc() | Applied upstream kernel commit 5057e1aca011e51ef51498c940ef96f3d3e8a305 |
| User Namespaces | Unprivileged CLONE_NEWUSER | Disable unprivileged user namespaces if not strictly required |
kernel/events/core.c | Event management routines | Apply patches for secondary findings, including CVE-2026-64300 |
The vulnerability was patched in the Linux kernel stable tree through commit 5057e1aca011e51ef51498c940ef96f3d3e8a305. Organizations running Linux desktop or server workloads should review their kernel versions, apply vendor updates promptly, and restrict unprivileged user namespaces where feasible.
The research effort also uncovered additional exploitable bugs in kernel/events/core.c, including CVE-2026-64300.
Together, these discoveries demonstrate that AI-assisted vulnerability research is accelerating bug discovery in core open-source infrastructure, making rapid patch management vital for enterprise security.
