CVE-2026-53264 · In the Linux kernel, the following vulnerability has been resolved:…

01 · The Real Story

Someone left a trapdoor in the floor of every Linux server's traffic-control room, and now the key is on GitHub

CVE-2026-53264 is a use-after-free race condition in the Linux kernel's traffic-control action layer (net/sched/act_api.c). When NEWTFILTER and DELFILTER netlink operations run concurrently, a tc_action object can be looked up under RCU read-side protection while a parallel delete path removes it from the IDR and frees it immediately — without waiting for the RCU grace period. The result is a dangling pointer that an attacker can reclaim with a controlled allocation. Affected kernels span Linux 4.14 through 7.1-rc6. Fixed stable releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13.

The vendor severity of HIGH / 7.8 is accurate and noisgate leaves it unchanged. The local-access requirement (AV:L) prevents an upgrade to CRITICAL — an attacker must already have a shell on the box. However, three factors keep this firmly in HIGH territory: (1) a fully public, weaponized exploit from STAR Labs succeeds in 10/10 test runs in 9–111 seconds on CentOS Stream 9; (2) the prerequisite kernel configs (CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER, unprivileged user namespaces) ship enabled by default on RHEL/CentOS, Ubuntu, Debian, and SUSE; (3) the Linux kernel is a canonical high-value-role component — root on a container host, KVM hypervisor, or CI runner has fleet-scale blast radius.

"Reliable local root exploit with public code; patch every Linux host on your standard HIGH cadence."

02 · The Attack Path

6 steps from start to impact.

STEP 01

Obtain local shell as unprivileged user

The attacker needs a low-privilege shell on a Linux host running a vulnerable kernel (4.14 – 7.1-rc6). This could come from compromised credentials, an application-layer RCE, or a malicious insider. No network-facing exposure is required for the kernel bug itself.

Conditions required:

Low-privilege local shell on target host
Kernel version in vulnerable range (4.14 – 7.1-rc6)

Where this breaks in practice:

Requires prior initial access — this is a post-compromise escalation, not an entry vector

Detection/coverage: EDR agents with process-lineage telemetry should flag unusual shell spawns; SSH audit logs capture credential-based access.

STEP 02

Verify prerequisite kernel configs

The attacker checks that unprivileged user namespaces are enabled (sysctl kernel.unprivileged_userns_clone or /proc/sys/user/max_user_namespaces > 0) and that CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER are compiled into the kernel or loaded as modules. On RHEL 9, Ubuntu 22.04+, and Debian 12+, all three are enabled by default.

Conditions required:

Unprivileged user namespaces enabled
CONFIG_NET_ACT_GACT built or loaded
CONFIG_NET_CLS_FLOWER built or loaded

Where this breaks in practice:

Hardened hosts that disable unprivileged user namespaces (e.g., kernel.unprivileged_userns_clone=0) block the entire chain
Custom-compiled minimal kernels may omit the tc modules

Detection/coverage: Auditd rules on unshare(CLONE_NEWUSER) syscalls can detect namespace creation attempts.

STEP 03

Create user + network namespace and set up tc races

Using the STAR Labs exploit (public on GitHub at star-sg/CVE/CVE-2026-53264), the attacker creates a user namespace, then a network namespace inside it, gaining CAP_NET_ADMIN within that namespace. They then issue concurrent NEWTFILTER and DELFILTER netlink messages to trigger the race on the tc_action object.

Conditions required:

Ability to create user namespace (CAP_SYS_ADMIN not required when unprivileged userns is enabled)

Where this breaks in practice:

The race window is tight — the published exploit needed 9–111 seconds across runs, meaning it is noisy and involves repeated syscalls that generate telemetry

Detection/coverage: Kernel audit subsystem and Falco/Tetragon can detect rapid tc netlink operations from non-root users inside new namespaces. Sysdig or eBPF-based agents can flag the pattern.

STEP 04

Reclaim freed slab object with controlled data

After the tc_action is freed, the attacker sprays the same slab cache with attacker-controlled objects (e.g., msg_msg or pipe_buffer) to reclaim the freed memory. The dangling pointer in the tc path now points to attacker-controlled data, giving a kernel read/write primitive.

Conditions required:

Kernel heap layout must be predictable enough for slab reclaim

Where this breaks in practice:

Slab randomization (CONFIG_SLAB_FREELIST_RANDOM) and AUTOSLAB (merged in 6.12+) reduce spray reliability
KASAN-enabled debug kernels will detect the UAF and panic instead of exploiting

Detection/coverage: KASAN (if enabled) generates a splat in dmesg. Production kernels typically do not run KASAN.

STEP 05

ROP chain to root

With an arbitrary kernel write, the attacker overwrites cred structures or modifies task_struct to escalate to UID 0. The published exploit uses a ROP chain with hardcoded offsets for the CentOS Stream 9 kernel; different distros/versions require offset recalculation but this is a mechanical exercise given debug symbols.

Conditions required:

Knowledge of kernel symbol offsets (available from /proc/kallsyms if kptr_restrict=0, or from distro debug packages)

Where this breaks in practice:

KASLR requires an info leak or brute force to locate gadgets — the published exploit handles this for CentOS 9 but would need adaptation per-distro
SMEP/SMAP prevent trivial userspace code execution from kernel context

Detection/coverage: EDR agents monitoring for setuid(0) from non-root processes or unexpected credential changes can catch the final escalation step.

STEP 06

Post-exploitation as root

With root on the host, the attacker can install persistence, dump credentials, pivot to other hosts, access container runtimes, or — on a hypervisor — interact with guest VMs. On CI/CD runners, root access enables supply-chain poisoning of build artifacts.

Conditions required:

Successful privilege escalation from step 5

Where this breaks in practice:

Immutable / read-only root filesystems (e.g., Flatcar, Bottlerocket, CoreOS) limit persistence options

Detection/coverage: File integrity monitoring, EDR, and container runtime security (Falco, Tetragon) detect post-exploitation activity.

03 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	No evidence of active exploitation as of 2026-08-05. Not listed in CISA KEV.
Proof of Concept	Public and weaponized. STAR Labs (researcher Lee Jia Jie) published full exploit source at star-sg/CVE/CVE-2026-53264. 10/10 success rate on CentOS Stream 9 in 9–111 seconds. Kyle Zeng (KyleBot) independently reported the bug.
EPSS	0.00205 (≈ top 15–20 percentile). Low probability of mass exploitation, consistent with local-only attack vector.
KEV Status	Not listed as of 2026-08-05.
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` — Local access, low complexity, low privilege, no user interaction. Full CIA impact but scope unchanged (no hypervisor escape modeled in the vector).
Affected Versions	Linux kernel 4.14 through 7.1-rc6. Essentially every maintained kernel branch for the past 9 years.
Fixed Versions	Upstream commit `5057e1aca011`. Stable backports: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1-rc7+. Ubuntu, Debian, SUSE patches pending on some branches; RHEL 9 fix available.
Scanning / Exposure	Local-only bug — no Shodan/Censys/GreyNoise exposure surface. Exposure is every Linux host with vulnerable kernel + default configs. Enterprise kernel audit via package manager is the detection method.
Disclosure Timeline	Upstream fix landed 2026-06-01. CVE published 2026-06-25. STAR Labs exploit published ~2026-07-21. Ubuntu/Debian/SUSE patches still rolling out.
Reporter	Kyle Zeng (KyleBot) reported to upstream. Lee Jia Jie (STAR Labs SG) independently discovered and published the weaponized exploit.

04 · The Call

noisgate verdict.

Final Verdict

= UNCHANGED to HIGH (7.8/10)

The single most decisive factor is the publicly weaponized, reliable local privilege escalation exploit targeting default kernel configurations shipped by every major enterprise distro. The local-only attack vector prevents an upgrade to CRITICAL, but the kernel's role as a canonical high-value component (hypervisors, container hosts, CI runners) establishes a HIGH floor that friction cannot erode.

HIGH Vulnerability existence and technical details (upstream commit, distro advisories)

HIGH Exploit reliability (published PoC with documented success rate)

MEDIUM In-the-wild exploitation status (absence of evidence is not evidence of absence; exploit is public and trivial to adapt)

Why this verdict

Public weaponized exploit with high reliability: STAR Labs published full source achieving 10/10 root shells in 9–111 seconds on CentOS Stream 9. Adapting to other distros is a mechanical offset-finding exercise given debug symbol packages.
Default configs satisfy all prerequisites: CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER, and unprivileged user namespaces are enabled by default on RHEL 9, Ubuntu 22.04+, Debian 12+, and SUSE 15 SP5+. The vast majority of enterprise Linux hosts are vulnerable out of the box.
Massive affected version range: Every kernel from 4.14 to 7.1-rc6 — nine years of releases — is vulnerable. Patching stragglers will exist for months.
Role multiplier: The Linux kernel is the canonical high-value-role component. On KVM hypervisors, root = access to all guest VMs (fleet-scale blast radius). On container hosts (Kubernetes nodes, Docker hosts), root = container escape and lateral movement across all pods. On CI/CD runners, root = supply-chain poisoning of build artifacts. On production database servers, root = full data exfiltration. ≥10% of Linux installs serve these high-value roles by definition, establishing a HIGH floor.
No in-the-wild exploitation yet: Despite the public exploit, no KEV listing and no campaign reports as of 2026-08-05. This prevents an upgrade to CRITICAL.

Why not higher?

CRITICAL would require either remote exploitability or active in-the-wild exploitation at scale. This bug requires local access (AV:L) — the attacker must already have a shell on the target host, which is a significant prerequisite that compounds with initial-access friction. The scope is unchanged (S:U), meaning the CVSS model does not account for hypervisor escape, and no demonstrated cross-boundary escape has been published.

Why not lower?

A downgrade below HIGH is blocked by the role-multiplier floor: the Linux kernel is definitionally a high-value-role component, and root access on hypervisors, container hosts, and CI runners produces fleet-scale or supply-chain-scale impact. The public, reliable exploit eliminates any complexity-based friction discount. Disabling unprivileged user namespaces is a viable compensating control but is not the default state, so it cannot justify a population-based downgrade.

05 · Compensating Control

What to do — in priority order.

Disable unprivileged user namespaces — Set sysctl kernel.unprivileged_userns_clone=0 or sysctl user.max_user_namespaces=0 (depending on distro). This breaks the exploit's ability to obtain CAP_NET_ADMIN inside a namespace, killing the chain at step 2. Deploy within 30 days per noisgate mitigation SLA for HIGH. Note: this may break Flatpak, Podman rootless, Chrome sandboxing — test in staging first.
Unload or blacklist tc action modules — If traffic control actions are not used, blacklist act_gact and cls_flower kernel modules via /etc/modprobe.d/. This removes the vulnerable code path entirely. Deploy within 30 days.
Enable kernel lockdown or kptr_restrict=2 — Set kernel.kptr_restrict=2 to hide kernel symbol addresses from unprivileged users, forcing the attacker to brute-force KASLR. Not a complete fix but raises exploit cost. Also consider lockdown=integrity on supported kernels.
Deploy eBPF-based runtime detection — Use Falco, Tetragon, or Tracee rules to alert on rapid tc netlink operations from non-root users inside new user namespaces. This detects exploitation attempts in near-real-time.

What doesn't work

Network firewalls / WAF / IDS — This is a local privilege escalation; no network traffic is involved in the exploit itself. Perimeter controls are irrelevant.
SELinux in targeted mode — The default RHEL targeted policy does not restrict tc netlink operations or user namespace creation for confined users. A custom policy could help but is not the default.
Container isolation alone — While containers limit the initial blast radius, the exploit targets the *host kernel*. If the container runtime allows user namespace creation (common in rootless setups), the exploit can escalate to host root.

06 · Verification

Crowdsourced verification payload.

Run this script on each target Linux host as any user (no root required). It checks kernel version against known-fixed versions, verifies prerequisite configs, and reports VULNERABLE, PATCHED, or UNKNOWN. Example: chmod +x check_cve_2026_53264.sh && ./check_cve_2026_53264.sh

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash\n# check_cve_2026_53264.sh — CVE-2026-53264 exposure check\n# Run on target Linux host. No root required.\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nset -euo pipefail\n\nKERNEL=$(uname -r)\nVERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\\.[0-9]+\\.[0-9]+')\n\nif [ -z "$VERSION" ]; then\n  echo "UNKNOWN — could not parse kernel version from: $KERNEL"\n  exit 2\nfi\n\nMAJOR=$(echo "$VERSION" | cut -d. -f1)\nMINOR=$(echo "$VERSION" | cut -d. -f2)\nPATCH=$(echo "$VERSION" | cut -d. -f3)\n\n# Known-fixed stable versions\nis_fixed=0\nif [ "$MAJOR" -lt 4 ]; then\n  # Kernels before 4.14 are not affected\n  is_fixed=1\nelif [ "$MAJOR" -eq 4 ] && [ "$MINOR" -lt 14 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 10 ] && [ "$PATCH" -ge 259 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 15 ] && [ "$PATCH" -ge 210 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 176 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 6 ] && [ "$PATCH" -ge 143 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 12 ] && [ "$PATCH" -ge 94 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 18 ] && [ "$PATCH" -ge 36 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -ge 13 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -ge 1 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -ge 8 ]; then\n  is_fixed=1\nfi\n\nif [ "$is_fixed" -eq 1 ]; then\n  echo "PATCHED — kernel $KERNEL is at or above a fixed version for CVE-2026-53264."\n  exit 0\nfi\n\n# Check prerequisites\nUSERNS=0\nif [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then\n  USERNS=$(cat /proc/sys/kernel/unprivileged_userns_clone)\nelif [ -f /proc/sys/user/max_user_namespaces ]; then\n  MAX_USERNS=$(cat /proc/sys/user/max_user_namespaces)\n  [ "$MAX_USERNS" -gt 0 ] && USERNS=1\nelse\n  # If neither sysctl exists, assume enabled (common default)\n  USERNS=1\nfi\n\nGACT=0\nif modinfo act_gact &>/dev/null || grep -q CONFIG_NET_ACT_GACT=y /boot/config-"$KERNEL" 2>/dev/null; then\n  GACT=1\nfi\n\nFLOWER=0\nif modinfo cls_flower &>/dev/null || grep -q CONFIG_NET_CLS_FLOWER=y /boot/config-"$KERNEL" 2>/dev/null; then\n  FLOWER=1\nfi\n\necho "Kernel:       $KERNEL (VULNERABLE version range)"\necho "Unprivileged user namespaces: $([ $USERNS -eq 1 ] && echo ENABLED || echo DISABLED)"\necho "CONFIG_NET_ACT_GACT:          $([ $GACT -eq 1 ] && echo PRESENT || echo ABSENT)"\necho "CONFIG_NET_CLS_FLOWER:        $([ $FLOWER -eq 1 ] && echo PRESENT || echo ABSENT)"\n\nif [ "$USERNS" -eq 1 ] && [ "$GACT" -eq 1 ] && [ "$FLOWER" -eq 1 ]; then\n  echo ""\n  echo "VULNERABLE — kernel $KERNEL is in the affected range and all exploit prerequisites are met."\n  exit 1\nelse\n  echo ""\n  echo "VULNERABLE — kernel is in the affected range but one or more exploit prerequisites are missing."\n  echo "Exploitation risk is reduced but patching is still required."\n  exit 1\nfi

07 · Bottom Line

If you remember one thing.

TL;DR

CVE-2026-53264 is a local privilege escalation with a public, reliable exploit that works on default RHEL/Ubuntu/Debian/SUSE kernel configs. Your Monday morning priority: (1) run the verification script across your fleet to identify hosts with all prerequisites met, (2) per the noisgate mitigation SLA for HIGH, deploy the compensating control — disable unprivileged user namespaces (kernel.unprivileged_userns_clone=0) — within 30 days on all hosts where it won't break application requirements (test against Flatpak, rootless Podman, Chrome first), (3) per the noisgate remediation SLA for HIGH, schedule kernel patching to fixed versions (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13+) within 180 days. Prioritize hypervisors, Kubernetes nodes, CI runners, and database hosts for the first patch wave. No in-the-wild exploitation has been reported yet, but the full exploit code is on GitHub — the clock is ticking.

Sources

Peer Review

What defenders are saying.

Submit a review attribution: handle + country only

0 flags selected · stored anonymously

Validation Results

Crowdsourced verification outputs.

Results submitted by users who ran the verification payload against their environment.