CVE-2026-53264 is a years‑old Linux kernel flaw that can let a local unprivileged user gain root privileges by exploiting a use‑after‑free in the net/sched subsystem, researchers say. The defect was disclosed July 27 after AI‑assisted research identified a race condition in the kernel's packet‑scheduling code and a patch was applied upstream that removes the vulnerable window.
Lee Jia Jie and STAR Labs
The vulnerability was discovered by Lee Jia Jie while interning at Singapore offensive security firm STAR Labs; it was his first Linux kernel work. Jia Jie said he used AI tools to locate the bug, produce a crash proof and improve the reliability of triggering the race condition. In addition to CVE‑2026‑53264, he reported two exploitable flaws in the perf events subsystem, one of which was assigned CVE‑2026‑64300.
Jia Jie targeted a CentOS Stream 9 desktop in testing. He described the defect as having existed for two to three years and presented his findings in the context of how AI changes the pace and style of vulnerability discovery.
net/sched race condition and the RCU mismatch
The fault sits in net/sched, the kernel component that controls when and how network packets are transmitted. According to the published analysis, the root cause is a mismatched locking pattern around a shared data structure: one function reads entries under a Read‑Copy‑Update (RCU) lock while another code path can free an entry without waiting for the RCU grace period.
That timing gap creates a race window in which the kernel may continue to access an object after its memory has been released. Successful exploitation can lead to local privilege escalation to root. However, exploitation as described requires unprivileged user namespaces and two supporting kernel options to be enabled — conditions that narrow the practical attack surface.
AI‑assisted discovery, crash proofs, and optimization
Jia Jie credited AI with accelerating several stages of the research: pinpointing the bug, generating a crash proof, and improving the reliability of trigger conditions. He also reported that optimization efforts reduced the time required to hit the race from more than 15 minutes to about five seconds.
He cautioned that AI showed blind spots and reasoning failures and asserted that detailed subsystem knowledge remains important to find weaknesses automated systems miss. The publication frames this work as following earlier efforts, noting that Google OSS‑Fuzz has previously used AI to expose hidden flaws in open‑source projects.
TyphoonPwn 2026, KyleBot, and the competitive angle
The exploit was prepared for TyphoonPwn 2026's Linux local privilege escalation category, which offered prizes of $70,000, $35,000 and $17,500. Jia Jie drew position eight of 11 competitors, but the category closed after three winners, and his entry was never demonstrated in the competition.
Separately, an AI system named KyleBot had independently reported the same bug two days before TyphoonPwn 2026. Jia Jie described the overlap as evidence that AI can make zero‑day work resemble n‑day analysis — turning long‑standing defects into newly exploitable conditions more quickly than before.
What this means for Linux users and administrators
The immediate remediation for affected installations is straightforward in technical terms: CVE‑2026‑53264 has been patched upstream. The upstream fix defers freeing the affected object until after the RCU grace period, which removes the use‑after‑free window the research exploited.
Linux users and administrators should obtain fixed kernels through their distribution's security update channels. Systems matching the test conditions — notably CentOS Stream 9 desktops with unprivileged user namespaces and the two kernel options described — are the most directly implicated. Separately, the perf events issues (one tracked as CVE‑2026‑64300) were reachable on Intel bare‑metal systems under a permissive performance‑monitoring setting and were noted as affecting RHEL‑based and Arch distributions rather than Debian‑based ones, making desktop Linux setups with permissive perf settings a focus for remediation.
The episode underscores two tightly linked facts: AI tooling can speed discovery and proof‑of‑concept development, and upstream patches that change a single memory‑management timing decision can close a longstanding privilege‑escalation window. For now, the clear, concrete next step for operators is to apply distribution updates that carry the upstream fix and to review whether their systems enable unprivileged user namespaces and the kernel options that made exploitation feasible.
Source: Infosecurity Magazine — AI-Assisted Bug Hunt Uncovers Linux Kernel 0-Day in net/sched
