AI-Assisted Research Finds Linux Kernel Zero-Day for Root Escalation

Key Takeaways

• A critical zero-day local privilege escalation (LPE) vulnerability, CVE-2026-53264, has been discovered in the Linux kernel.
• The flaw resides in the net/sched packet scheduling subsystem, allowing unprivileged local attackers to gain root access.
• The discovery was significantly aided by AI-assisted research tools, demonstrating the evolving landscape of vulnerability hunting.
• A patch is available in the Linux kernel stable tree, and organizations should apply updates promptly.

AI-Assisted Research Uncovers Linux Kernel Zero-Day

Security researchers have uncovered a severe zero-day vulnerability in the Linux kernel, identified as CVE-2026-53264, which enables local privilege escalation (LPE) to root. This discovery not only highlights persistent security challenges within complex kernel components but also underscores the increasing efficacy of artificial intelligence in vulnerability research.

The flaw is a use-after-free (UAF) condition affecting the Linux kernel’s net/sched packet scheduling subsystem. Under specific conditions, this vulnerability allows a local attacker to achieve root privileges on a compromised system.

The Role of AI in Vulnerability Discovery

The research effort transitioned from analyzing known 1-day vulnerabilities to actively hunting for zero-day flaws. Throughout this process, AI-assisted tools played a crucial role, accelerating various stages of the research pipeline. These stages included initial bug discovery, the generation of KASAN (Kernel Address Sanitizer) proof-of-concept exploits, and the intricate optimization of race-condition timing.

While AI tools dramatically improved the speed and iteration cycles of the research, human expertise remained indispensable. Manual analysis was particularly critical for refining exploitation logic and validating the real-world impact of the discovered vulnerability.

Technical Details of the Vulnerability

According to findings published on the Slippy Blog, the core issue lies in a race condition within the tcf_idr_check_alloc() function. This function is responsible for managing shared traffic control actions within the net/sched subsystem, which governs how network packets are queued, filtered, and transmitted.

Specifically, the vulnerable code performs an action lookup under Read-Copy-Update (RCU) read-side protection. However, the same object can be freed asynchronously without waiting for an RCU grace period. This mismatch in locking mechanisms creates a narrow window where a freed action object can still be referenced, leading to a exploitable use-after-free condition.

Exploitation Path and Impact

The exploit circumvents standard restrictions by avoiding the RTM_NEWACTION and RTM_DELACTION netlink routes, which typically require elevated network administration capabilities (CAP_NET_ADMIN) in the initial network namespace. Instead, the researchers abused RTM_NEWTFILTER and RTM_DELTFILTER. This approach allows exploitation from within an unprivileged user namespace, where CAP_NET_ADMIN is locally available.

Successful exploitation hinges on the host system having unprivileged user namespaces enabled. The researchers combined specific queueing and filter types, including clsact and flower, to bypass locking paths that would otherwise obstruct winning the race condition. This method aligns with common privilege escalation tactics seen in attacks targeting unpatched Linux kernel flaws in enterprise environments.

The exploit execution chain involves several critical components:

• KASLR Bypass: Obtaining a kernel address space layout randomization leak.
• Heap Reclamation: Reclaiming freed memory using KEYCTL_UPDATE calls.
• Payload Delivery: Constructing a Return-Oriented Programming (ROP) sequence to overwrite /proc/sys/kernel/core_pattern.
• Code Execution: Triggering attacker-controlled binaries with root privileges via core dump execution.

During testing, the exploit was optimized for CentOS Stream 9 desktop configurations and demonstrated reliable root compromise in repeated runs, often completing in under 10 seconds. While the exploit required kernel-specific gadget offsets and precise timing, these findings confirm its practicality and weaponizability against real Linux desktop targets. Such exploitation mechanics are consistent with other recent local privilege escalation vectors targeting Linux server and desktop distributions.

The research also led to the discovery of additional exploitable bugs in kernel/events/core.c, including CVE-2026-64300. These combined discoveries highlight how AI-assisted vulnerability research is accelerating the identification of critical bugs in core open-source infrastructure, emphasizing the necessity of rapid patch management for robust enterprise security.

What You Should Do

• Apply Kernel Updates: The vulnerability has been patched in the Linux kernel stable tree via commit 5057e1aca011e51ef51498c940ef96f3d3e8a305. Organizations must promptly review their kernel versions and apply vendor-provided updates for both CVE-2026-53264 and CVE-2026-64300.
• Restrict Unprivileged User Namespaces: If not strictly required for operational purposes, consider disabling unprivileged user namespaces on Linux systems to mitigate this and similar privilege escalation risks.
• Monitor for Vendor Advisories: Stay informed of advisories from your Linux distribution vendor regarding these vulnerabilities and follow their recommended patching schedules.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.