Linux kernel traffic-control subsystem use-after-free race
Use-after-free race in the Linux kernel's tc subsystem lets a local user escalate to root. CVSS 7.8 high. Public exploit for CentOS Stream 9 published by STAR Labs.
- Vendor
- Linux
- Product
- Linux Kernel (traffic-control subsystem)
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.5%
- Status
- unpatched
- Published
Is CVE-2026-53264 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-53264 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-04 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-04. Full cross-catalog view: /kev-comparison
CVE-2026-53264 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
A use-after-free race condition in the Linux kernel’s network traffic-control (tc) subsystem allows an unprivileged local user to corrupt kernel memory and escalate to root. Demonstrated on CentOS Stream 9 by STAR Labs researcher Lee Jia Jie, who noted AI tooling accelerated both bug discovery and exploit development. CVSS 7.8.
Patch status: no vendor patch has been announced as of July 28, 2026. Check your distribution’s security advisories. Red Hat, Debian, Ubuntu, and SUSE typically respond to kernel LPEs of this size within days of public disclosure.
Primary exposure: multi-tenant Linux systems, shared servers, and containerized workloads where untrusted users hold shell access.
Other Linux Kernel CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerabilitywrite-up | [ HIGH ] | 7.8 | 16.1% | |
| CVE-2026-98432 Linux Kernel IPv4 TCP Use-After-Freewrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
| CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 0.9% | |
| CVE-2025-39964 Linux Kernel Race Condition Vulnerabilitywrite-up | [ HIGH ] | 7.8 | 1.6% | |
| CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 3.3% | |
| CVE-2026-53362 Linux Kernel Unspecified Vulnerability | [ HIGH ] | 7.8 | 0.7% | |
| CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability | [ HIGH ] | 7.8 | 8.9% | |
| CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability | [ HIGH ] | 7.8 | 5.5% |
