AI-Assisted Linux Kernel Exploit Hits CentOS Stream 9 via Traffic-Control Race
Security researcher Lee Jia Jie of STAR Labs has published a working Linux kernel exploit that escalates an unprivileged local user to root on CentOS Stream 9, leveraging a use-after-free race condition tracked as CVE-2026-53264 with a CVSS score of 7.8. The flaw resides in the kernel's network traffic-control subsystem, where concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one thread reading an action object after another has freed it. In his technical write-up, Lee credited artificial intelligence with assisting in vulnerability discovery, generating a Kernel Address Sanitizer (KASAN) proof of concept, and optimizing the race window, though he cautioned that human judgement remained essential. Without access to the model, prompts, or interaction logs, the disclosure is difficult to benchmark as a measure of pure AI capability.
The exploit is a local privilege escalation rather than remote code execution, meaning an attacker must already hold a foothold on the target machine. Successful exploitation requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER kernel options, and a kernel-specific return-oriented programming (ROP) chain containing hardcoded offsets. The PoC creates namespace-local CAP_NET_ADMIN rights, reaches the vulnerable path through a clsact qdisc and flower filter, uses timerfd and epoll calls to widen the race window, and then overwrites core_pattern with a ROP chain that loads a memfd-resident payload. STAR Labs has released the full CentOS-targeted source code, broadening the risk for any organization running unpatched kernels. Administrators can audit exposure with a port scanner and verify system hardening via a privacy checkup.
The upstream patch landed on June 1, 2026, deferring the free operation until existing read-copy-update (RCU) readers have finished. Fixed releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13, with the mainline fix entering 7.1-rc7, while vulnerable code traces back to Linux 4.14. The Hacker News found no entry for CVE-2026-53264 in CISA's Known Exploited Vulnerabilities catalog and no confirmed in-the-wild exploitation as of late July 2026, but the public release of working exploit code raises the urgency considerably. Linux users should install a distribution kernel carrying the backport rather than relying on upstream version numbers alone, and security teams should prioritize patching CentOS Stream 9 hosts and any container or VM escape paths where this primitive could chain into broader compromise.