Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
10:04 · July 28, 2026 · Hacker News AI Section
STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264 (CVSS score: 7.8), is a use-after-free race in the kernel's network traffic-control subsystem.Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local
Summary
A security researcher at STAR Labs has demonstrated a local privilege-escalation exploit against a use-after-free race condition in the Linux kernel’s network traffic-control subsystem. Tracked as CVE-2026-53264 and rated 7.8 by the Linux CNA, the flaw allows an unprivileged local user to obtain root on affected systems such as the CentOS Stream 9 build used for testing. The vulnerability arises when concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations leave one thread accessing an action object after another thread has freed it; the upstream patch resolves the race by deferring the free until RCU readers complete.
Researcher Lee Jia Jie reported that AI tooling assisted in locating the bug, generating a Kernel Address Sanitizer proof-of-concept, and tightening the timing window for the race. The resulting exploit creates its own user and network namespaces to obtain namespace-local CAP_NET_ADMIN, then reaches the vulnerable path through a clsact qdisc and flower filter. Timerfd and epoll operations widen the window, payload allocations reclaim the freed object, and a kernel-specific return-oriented-programming chain overwrites core_pattern so that a deliberately crashed child process executes the attacker’s memfd-backed binary as the root core-dump handler.
The attack requires unprivileged user namespaces together with the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER options, plus hardcoded offsets that tie the binary to a particular kernel build. Lee observed reliable success across ten test runs on a laptop, with times ranging from nine to 111 seconds, yet these figures remain unreproduced and the exploit must be rebuilt for other distributions. Although the public release of the code increases urgency for unpatched systems, the prerequisites limit immediate exposure compared with a generic remote or unauthenticated attack.
The upstream fix landed on 1 June 2026 and has been backported to several stable branches, with fixed releases including 5.10.259, 5.15.210, 6.1.176 and later. Lee emphasized that AI still exhibits blind spots and lapses in reasoning, underscoring that human oversight remained essential throughout discovery, exploit refinement and validation.
Why it matters
This article is highly relevant for security professionals as it demonstrates the practical application of AI in offensive cybersecurity and vulnerability research. It highlights a specific Linux kernel vulnerability that Dutch enterprises must patch, while also signaling the evolving threat landscape where AI accelerates exploit development.
