In a significant breakthrough in cybersecurity, STAR Labs has revealed a Linux kernel flaw that allows a standard local user to gain root privileges on the targeted CentOS Stream 9. Tracked as CVE-2026-53264 with a CVSS score of 7.8, this vulnerability emerges from a use-after-free race in the kernel’s network traffic-control subsystem. Researcher Lee Jia Jie credited artificial intelligence (AI) for expediting the identification and development of the exploit. Although this is a local privilege escalation and not a remote code execution, it still requires an intruder to have initial access to the machine.
Exploit Development and Requirements
The exploit demands specific conditions, including unprivileged user namespaces and particular kernel configurations like CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER. Additionally, a kernel-specific return-oriented programming (ROP) chain with hardcoded offsets is necessary. Despite these constraints narrowing the vulnerability’s immediate impact, the complete exploit code is now publicly accessible, raising concerns for unpatched systems.
An upstream fix was introduced on June 1, 2026, and has been backported to various stable kernel branches. Vulnerable versions start from Linux 4.14, while fixed versions include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13. Users are advised to update to a distribution kernel with the fix, rather than depending solely on version numbers.
AI’s Role in Vulnerability Detection
In his technical documentation, Lee elaborated on AI’s role in detecting the vulnerability, crafting a Kernel Address Sanitizer (KASAN) proof of concept, and refining the race window. While AI facilitated these processes, Lee emphasized the necessity of human judgment throughout. STAR Labs has yet to disclose specific details regarding the AI system utilized, the testing circumstances, or the timeline for public disclosure.
The flaw is rooted in the handling of Linux traffic-control actions, where concurrent operations could result in one thread accessing an action object that another has already freed. The patch addresses this by postponing the free operation until all readers have completed their tasks.
Implications and Future Outlook
The exploit manipulates user and network namespaces to acquire namespace-local CAP_NET_ADMIN without host administrator rights. It exploits a clsact qdisc and flower filter to access the vulnerable path, utilizing timerfd and epoll operations to extend the race window and reclaim the freed object. The ROP chain subsequently alters core_pattern.
In trials conducted by Lee, the exploit was consistently effective, though its reliance on fixed gadget offsets necessitates rebuilding for other kernel versions, potentially limiting its adaptability. While the immediate threat may be limited, the release of public exploit code highlights the urgency for systems to apply patches.
The vulnerability’s discovery credits Kyle Zeng, also known as KyleBot, who reportedly identified the flaw independently before it was disclosed at the TyphoonPwn 2026 competition. As of late July 2026, distribution status remains varied, with some systems still marked as vulnerable. The public availability of the exploit underscores the need for expedient action to mitigate potential risks.
