Linux Kernel tc Race Yields Root Exploit (CVSS 7.8)

A working privilege-escalation exploit for CVE-2026-53264 is public. STAR Labs researcher Lee Jia Jie developed and published it: a use-after-free race in the Linux kernel’s traffic-control (tc) subsystem, validated against CentOS Stream 9. NVD rates it CVSS 7.8 — high severity.

The traffic-control subsystem handles packet classification and bandwidth shaping. The bug is in how tc frees and reuses memory during a race; triggering it from a local unprivileged user position can corrupt kernel state and hand an attacker root. This is local-only: the attacker needs an existing foothold, not network access. That’s what puts the score at 7.8 instead of 9+.

The AI angle is worth noting. Lee Jia Jie stated that AI tooling helped him locate the vulnerability and compressed the time to a working exploit. Kernel race conditions have historically required significant expertise and weeks of work to weaponize. AI-assisted research doesn’t find bugs that experts can’t — it gets a competent researcher to a working primitive faster. That’s a different threat model than “AI discovers novel vulns,” and it’s the one that’s actually happening now.

What to do

Assess exposure first:

• Do untrusted users hold shell access on your systems? Container workloads sharing host network namespaces? That’s the exposure class.
• CentOS Stream 9 is the confirmed target. RHEL 9 derivatives and distributions sharing that kernel lineage should be treated as potentially affected until your distro issues guidance.
• Standard multi-user Linux environments — shared servers, VMs with multiple accounts — are the priority audit targets.

Patch steps:

1. Check your distribution’s security advisory for CVE-2026-53264. Red Hat, Debian, Ubuntu, and SUSE all move quickly on kernel LPEs at this CVSS level.
2. If a patched kernel is available, apply it at your next maintenance window. CVSS 7.8 with local access prerequisites doesn’t justify an emergency reboot unless you’re running exposed multi-tenant infrastructure where the threat is real and immediate.
3. If no patch is yet available, confirm that unprivileged users cannot access tc configuration interfaces — review your network namespace configuration and restrict access where your environment permits it.

Priority call: Remote CVSS 9+ flaws being actively exploited against your perimeter still outrank this for most environments. If you’re running single-tenant infrastructure with no untrusted shell access, schedule the patch. If you’re running multi-tenant or shared systems, move it up — local LPE to root in that context is a full compromise.

Earlier this month, RefluXFS (CVE-2026-64600) hit default RHEL, Fedora, and Amazon Linux builds via a nine-year-old XFS race. The tc subsystem is a different code path and a different exposure surface — check both on any system where kernel patching has slipped.

Sources: The Hacker News, NVD CVE-2026-53264.