CVE-2026-53264PoC(linux / linux_kernel)

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 19 mentions and remains active

Immediate actions

Patch linux linux_kernel systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.

linux CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Patch / fix

Other references

Weakness type (CWE)

CWE-416

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
37 mentions across 10 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 10 signals
PoC mentioned or linked in 19 signals
Patch or workaround mentioned in 10 signals
Technical details provided in 28 signals
Disclosure: 11 classified signals
Peaked 8d ago at 19 mentions (2026-07-28); latest day: 2
37 total mentions across 10 days

Affected systems

Vendors

linux

Products

linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline37 mentions / 10d

Signal classification6 categories

PoC

1335.1%

Disclosure

1129.7%

Exploit

616.2%

General

513.5%

Active Exploitation

12.7%

Patch

12.7%

Referenced assets19 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-27	1	General1
2026-07-28	19	Active Exploitation1Disclosure4Exploit3General3Patch1PoC7
2026-07-29	6	Disclosure3Exploit2PoC1
2026-08-03	1	Exploit1
2026-08-04	2	General1PoC1
2026-08-05	2	PoC2
2026-08-15	1	Disclosure1
2026-08-31	2	Disclosure2
2026-09-13	1	Disclosure1
2026-10-23	2	PoC2

Full discourse20 posts

The Hacker News@TheHackersNews91d
Disclosure
🛑 A researcher says AI helped turn a #Linux traffic-control race into a root exploit. CVE-2026-53264 lets a local user gain root on the tested CentOS Stream 9 build, but needs user namespaces, specific kernel options, and build-specific ROP offsets. Read how the exploit works: https://thehackernews.com/2026/07/researcher-says-ai-helped-develop-linux.html
Post summary
Researcher reports AI helped convert a Linux traffic‑control race into a root exploit (CVE-2026-53264) on CentOS Stream 9, needing user namespaces, specific kernel options, and build‑specific ROP offsets.
34341495647.4K
2.3M followersView on X
ThreatWire@ThreatWire_90d
PoC
🚨 A public PoC has been released for CVE-2026-53264 affecting the Linux kernel. The vulnerability is a Use-After-Free (UAF) race condition in net/sched which may lead to memory corruption and potential code execution. 🔗 https://github.com/horkimhab/cve-2026-53264 #Linux #UAF #CVE #CyberSecurity
Post summary
The post announces a publicly available PoC for CVE-2026-53264, a Use‑After‑Free race condition in the Linux kernel’s net/sched that could allow code execution.
019272294.8K
1.5K followersView on X
elhacker.NET@elhackernet90d
Disclosure
IA descubre zero-day en kernel de Linux para escalar privilegios root Investigadores de seguridad han descubierto una vulnerabilidad zero-day crítica en el núcleo de Linux, identificada como CVE-2026-53264 https://blog.elhacker.net/2026/07/ia-descubre-zero-day-en-kernel-de-linux.html
Post summary
Researchers have announced the discovery of a critical zero‑day privilege escalation vulnerability in the Linux kernel (CVE-2026-53264), but no further technical, exploit or mitigation details are provided.
01505295.2K
141.9K followersView on X
Daily CyberSecurity@Daily_CyberSec83d
PoC
A Linux kernel vulnerability, CVE-2026-53264, lets a local user run arbitrary code via a net/sched use-after-free. A public PoC is now available. #CVE202653264 #LinuxKernel #UseAfterFree #PrivilegeEscalation #InfoSec http://securityonline.info/linux-kernel-cve-2026-53264/
Post summary
The post announces that CVE‑2026‑53264 is a local privilege escalation in the Linux kernel, and a public proof‑of‑concept is now available, with no evidence of active exploitation or remediation steps.
04119101.5K
13.0K followersView on X
Aikido Community Japan@AikidoCommJP90d
PoC
Linuxで、一般ユーザーからroot権限を奪える脆弱性と、その実証コードが公開されました（CVE-2026-53264）。これは、インターネットから直接Linuxを乗っ取る脆弱性ではありません。攻撃者がすでに何らかの方法で、そのLinux上で一般権限のコードを動かせることが前提です。例えば。盗まれたログイン情報。脆弱なWebアプリから侵入されたサービス。不正なコードを実行してしまったCI環境。そこからroot、つまりLinux全体を管理できる権限まで昇格される可能性があります。公開された実証コードはCentOS Stream 9向けですが、脆弱性そのものはCentOS限定ではありません。 Linuxカーネル4.14以降の複数の系列が対象です。ただし、「4.14以降なら全部危険」とも言い切れません。 UbuntuやDebian、RHELは、バージョン番号を変えずに修正だけを取り込む（バックポート）ことがあるからです。つまり、uname -r の数字だけでは「対象／対象外」を判定できません。上流Linuxでの修正版は次のとおりです。 5.10 → 5.10.259 5.15 → 5.15.210 6.1 → 6.1.176 6.6 → 6.6.143 6.12 → 6.12.94 6.18 → 6.18.36 7.0 → 7.0.13 mainline → 7.1-rc7 同じ系列でこれより古ければ、対象の可能性があります。確認は、この順番です。まず、自分の環境。 cat /etc/os-release uname -r 次に、ディストリビューションがCVE-2026-53264へ対応済みか確認します。 Ubuntu／Debian系 sudo apt update apt list --upgradable 2>/dev/null | grep -E 'linux-image|linux-headers' RHEL／Rocky／AlmaLinux／Oracle Linux系 sudo dnf updateinfo info --cves CVE-2026-53264 ※CentOS Streamはerrata情報を持たないため、updateinfoでは判定できないことがあります。実証コードの成立には、一般ユーザー用の名前空間と、特定のカーネル機能が有効であることも必要です。名前空間（RHEL系） sysctl user.max_user_namespaces 0なら無効です。名前空間（Ubuntu／Debian系） sysctl kernel.unprivileged_userns_clone 0なら無効です。カーネル機能 grep -E 'CONFIG_NET_ACT_GACT|CONFIG_NET_CLS_FLOWER' /boot/config-$(uname -r) このファイルが無い場合は、 zcat /proc/config.gz | grep -E 'CONFIG_NET_ACT_GACT|CONFIG_NET_CLS_FLOWER' を試してください。両方が =y または =m なら、必要な機能が組み込まれています。ただし、条件を確認するより、修正済みカーネルへ更新する方が確実です。そして、ここが見落としやすい点です。 apt upgrade や dnf update を実行しただけでは、古いカーネルが動き続けていることがあります。必ず再起動し、 uname -r で実際に新しいカーネルが動いていることまで確認してください。どのディストリビューションでも、一番確実なのは、「修正済みカーネルへ更新 → 再起動 → uname -r で確認」です。もう一つ注目したいのは、AIです。研究者によると、AIは脆弱性の発見だけでなく、実証コードの作成や、攻撃を成功させるタイミングの調整にも使われました。一方で研究者自身は、「AIには依然として多くの盲点があり、作業を通じて人間の判断が必要だった」とも述べています。今回のポイントは、「AIが最初に脆弱性を発見した」ことではありません。 AIが、見つかった脆弱性を実際の攻撃コードへ仕上げる作業をどこまで加速できるか。その実例として注目したい事例です。 #Linux #セキュリティ #脆弱性 #権限昇格 #AI
Post summary
The post announces the CVE‑2026‑53264 privilege‑escalation flaw, provides proof‑of‑concept code, and gives detailed patch information, but does not report active exploitation.
0211383.0K
856 followersView on X
ɐpnH@AlAssaf_H57d
Disclosure
CVE-2026-53264: net/sched act_api UAF. Race: RTM_NEWTFILTER × RTM_DELTFILTER in tcf_idr_check_alloc() — IDR lookup under RCU, immediate kfree on delete. Needs unprivileged userns. AI cut trigger time ~15m → ~5s. Fix: defer free across RCU grace period. https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/
Post summary
The text announces the discovery of CVE‑2026‑53264, detailing the race‑condition based use‑after‑free vulnerability and the corresponding fix, without revealing a PoC, exploit, or active exploitation.
04096548
926 followersView on X
OS開発者@hacker_infra91d
Patch
またかよ！！ Upstream patch: https://git.kernel.org/torvalds/c/5057e1aca011e51ef51498c940ef96f3d3e8a305 Red Hat: https://access.redhat.com/security/cve/cve-2026-53264
Post summary
A patch is available: the upstream project has committed a fix, and Red Hat has published a security advisory for CVE‑2026‑53264.
0411316.1K
2.9K followersView on X
dbugs@ptdbugs90d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-53264 PT ID: PT-2026-52359 Vendor: Linux Product: Linux Description: A race condition exists in the net/sched component when NEWTFILTER and DELFILTER operations are executed concurrently. This occurs because an action can be freed immediately via kfree() while another CPU still holds a pointer to it, leading to a Use-After-Free (UAF) scenario. UAF is a memory corruption issue where a program continues to use a pointer after the memory it points to has been freed. The issue is triggered during the interaction between idr find() and idr remove() functions when managing the action lifecycle. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-52359 • https://github.com/horkimhab/cve-2026-53264 #dbugs_vuln
Post summary
A proof‑of‑concept exploit for the undefined behavior race condition in Linux’s net/sched component (CVE‑2026‑53264) has been published with technical details and a GitHub repo, though no active exploitation or patch info is mentioned.
00081701
3.5K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi72d
Disclosure
في باحث من STAR Labs يقول إن AI ساعده يرجع لـRace Condition قديمة في Linux ويحوّلها إلى Local Privilege Escalation تعمل على CentOS Stream 9. رقم الثغرة: CVE-2026-53264
Post summary
A STAR Labs researcher reports that an old race condition in Linux has been transformed into a local privilege escalation on CentOS Stream 9, but no exploit code, patch, or active exploitation details are provided.
00023615
50.2K followersView on X
iototsecnews@iototsecnews83d
PoC
Linux Kernel のゼロデイ脆弱性 CVE-2026-53264：AI による競合状態の解明と PoC の提供 https://iototsecnews.jp/2026/07/28/ai-discovered-linux-kernel-zero-day-enables-root-privilege-escalation/ Linux カーネルに存在する CVE-2026-53264 は、ネットワーク処理の仕組みにおいてメモリが不適切に扱われることで発生します。処理のタイミングが重なると、本来は保護されるべきメモリ領域への意図しないアクセスが生じることを、AI を活用する研究者が発見しました。この脆弱性が悪用されると、一般的な利用権限しか持たない状態から、システム全体を管理できる最も強い権限を不正に取得される恐れがあります。影響を最小限に抑え、システムを安全に利用するためにも、修正済みの新しいバージョンへ速やかに更新してください。あわせて、必要のないユーザーによる特殊な権限の利用を制限する設定の見直しも効果的です。 #CVE202653264 #Kernel #Linux #PoC #Vulnerability #ZeroDay
Post summary
Researchers disclosed a zero‑day race condition in the Linux kernel, released a PoC, and urged users to apply the fix and review privileged settings.
02011189
506 followersView on X
Ryx@PadhiyarRushi43d
Disclosure
CVE-2026-53264: race in Linux net/sched. Mismatched locking: one path reads under RCU, another frees without waiting for the grace period → use-after-free. AI-assisted discovery (and an independent AI system found the same bug days earlier). Years-old flaw, reliable LPE once the race is won. Another reminder that networking subsystems still hide long-lived synchronization bugs. https://www.infosecurity-magazine.com/news/ai-linux-kernel-zero-day-net-sched/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #KernelSecurity #PrivilegeEscalation
Post summary
The text discloses technical details about CVE-2026-53264, describing a Linux net/sched race condition leading to a use-after-free and possible LPE. It does not mention PoC code, a named exploit tool, active exploitation, or remediation.
00021179
953 followersView on X
Rıdvan Yağlı@ridvanyagli90d
General
CVE-2026-53264 Linux Kernel LPE https://t.co/wOhdlJSkv1
Post summary
The tweet merely references CVE-2026-53264 as a Linux Kernel local privilege escalation vulnerability, without providing additional details on PoC, exploitation, or patching.
01110533
1.3K followersView on X
Autumn Good@autumn_good_3591d
General
インターンで初めてLinuxカーネルに触れてゼロデイを見つけるあたりはさすがSTAR Labsですね... CVE-2026-53264、CVE-2026-64300 When AI Makes 0-Days Feel Like N-Days https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/
Post summary
The text announces the discovery of CVE-2026-53264 and CVE-2026-64300 by STAR Labs and links to a blog post, but does not provide detailed technical or exploit information.
10110980
7.0K followersView on X
CyberNewsDaily@NewsDaily1857991d
Disclosure
🟠 Linux bug CVE-2026-53264 (CVSS: 7.8/10) [EPSS: 0.1%] allows local users to gain root access via AI-assisted vulnerability hunt. All CentOS Stream 9 build users potentially impacted via the network traffic-control subsystem. via The Hacker News #Linux #CVE-2026-53264 https://t.co/8hEg849BZg
Post summary
The tweet announces a newly disclosed Linux vulnerability (CVE-2026-53264) with a CVSS score of 7.8, noting potential impact on CentOS Stream 9 users via the network traffic-control subsystem.
1001038
16 followersView on X
OS開発者@hacker_infra83d
General
https://access.redhat.com/security/cve/cve-2026-53264 Red hatに報告したが、まだカーネルのバージョンアップがでないな。
Post summary
User reports CVE‑2026‑53264 to Red Hat, noting that the kernel upgrade patch is not yet available.
00010240
2.8K followersView on X
CyberTLDR@CyberTLDR89d
Disclosure
2/3 CVE-2026-53264 is a race in the kernel net/sched traffic-control code. The exploit needs unprivileged user namespaces enabled, then wins the race to corrupt kernel memory and escalate a normal user to root. #CVE #InfoSec #Linux
Post summary
CVE-2026-53264 is a kernel race condition that can be exploited via unprivileged user namespaces to gain root; no PoC, patch, or active exploitation noted.
1000033
37 followersView on X
Lucas@lucasverdan90d
Exploit
🛑 AI-Assisted Linux Kernel Exploit Turns a Traffic-Control Race Into Root… STAR Labs published a working local root exploit for CVE-2026-53264, a Linux kernel net/sch… 🔗 Details → https://invaders.ie/resources/blog/vulnerability/ai-assisted-linux-kernel-cve-2026-53264-root-exploit
Post summary
The post announces that STAR Labs released a working local root exploit for CVE‑2026‑53264, a race‑condition vulnerability in the Linux kernel traffic‑control subsystem, with a link to detailed information, but no mention of active exploitation or patches.
0100056
304 followersView on X
Mihoko Matsubara　松原実穂子@M_Miho_JPN90d
Disclosure
A years-old Linux kernel flaw allowing local privilege escalation to root has been disclosed after AI-assisted research uncovered a race condition in net/sched. Lee Jia Jie of STAR Labs said he found the use-after-free during an internship. CVE-2026-53264. https://www.infosecurity-magazine.com/news/ai-linux-kernel-zero-day-net-sched/
Post summary
An older Linux kernel flaw (CVE‑2026‑53264) that permits local privilege escalation via a use‑after‑free race condition in net/sched has been publicly disclosed by AI‑assisted research.
10000214
6.9K followersView on X
Green Shell@green_sh3ll90d
PoC
Another week, another ⚠️ Linux kernel LPE Public PoC just dropped for CVE-2026-53264 — a Use-After-Free race in net/sched that can lead to memory corruption and root.
Post summary
A public PoC for CVE-2026-53264, a Linux kernel Use‑After‑Free that can lead to root, has been released, with no evidence of active exploitation or patch availability.
0000175
9 followersView on X
Rıdvan Yağlı@ridvanyagli90d
PoC
CVE-2026-53264 PoC: https://github.com/horkimhab/cve-2026-53264
Post summary
A Proof of Concept for CVE‑202uunniit‑53264 is provided via a GitHub repository, indicating the vulnerability has been demonstrated/exploited in code.
00001342
1.3K followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-

Explore more

Back to dashboard linux CVEs linux_kernel vulnerabilities

What researchers are saying

CVE-2026-53264

ThreatWire[verified]@ThreatWire_PoC

The post announces a publicly available PoC for CVE-2026-53264, a Use‑After‑Free race condition in the Linux kernel’s net/sched that could allow code execution.

Aikido Community Japan[verified]@AikidoCommJPPoC

The post announces the CVE‑2026‑53264 privilege‑escalation flaw, provides proof‑of‑concept code, and gives detailed patch information, but does not report active exploitation.

ɐpnH[verified]@AlAssaf_HDisclosure

The text announces the discovery of CVE‑2026‑53264, detailing the race‑condition based use‑after‑free vulnerability and the corresponding fix, without revealing a PoC, exploit, or active exploitation.

OS開発者[verified]@hacker_infraPatch

A patch is available: the upstream project has committed a fix, and Red Hat has published a security advisory for CVE‑2026‑53264.

dbugs[verified]@ptdbugsPoC

A proof‑of‑concept exploit for the undefined behavior race condition in Linux’s net/sched component (CVE‑2026‑53264) has been published with technical details and a GitHub repo, though no active exploitation or patch info is mentioned.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediDisclosure

A STAR Labs researcher reports that an old race condition in Linux has been transformed into a local privilege escalation on CentOS Stream 9, but no exploit code, patch, or active exploitation details are provided.

Ryx[verified]@PadhiyarRushiDisclosure

The text discloses technical details about CVE-2026-53264, describing a Linux net/sched race condition leading to a use-after-free and possible LPE. It does not mention PoC code, a named exploit tool, active exploitation, or remediation.

Rıdvan Yağlı[verified]@ridvanyagliGeneral

The tweet merely references CVE-2026-53264 as a Linux Kernel local privilege escalation vulnerability, without providing additional details on PoC, exploitation, or patching.