CVE-2026-53264 · Linux Kernel net/sched act_api Use-After-Free Local Privilege…

01 · The Real Story

Someone left a trapdoor in the floor of every Linux server's traffic-control room, and now the key is on GitHub

CVE-2026-53264 is a use-after-free race condition in the Linux kernel's traffic-control action layer (net/sched/act_api.c). When NEWTFILTER and DELFILTER netlink operations run concurrently, a tc_action object can be looked up under RCU read-side protection while a parallel delete path removes it from the IDR and frees it immediately — without waiting for the RCU grace period. The result is a dangling pointer that an attacker can reclaim with a controlled allocation. Affected kernels span Linux 4.14 through 7.1-rc6. Fixed stable releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13.

The vendor severity of HIGH / 7.8 is accurate and noisgate leaves it unchanged. The local-access requirement (AV:L) prevents an upgrade to CRITICAL — an attacker must already have a shell on the box. However, three factors keep this firmly in HIGH territory: (1) a fully public, weaponized exploit from STAR Labs succeeds in 10/10 test runs in 9–111 seconds on CentOS Stream 9; (2) the prerequisite kernel configs (CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER, unprivileged user namespaces) ship enabled by default on RHEL/CentOS, Ubuntu, Debian, and SUSE; (3) the Linux kernel is a canonical high-value-role component — root on a container host, KVM hypervisor, or CI runner has fleet-scale blast radius.

"Reliable local root exploit with public code; patch every Linux host on your standard HIGH cadence."

02 · The Attack Path

6 steps from start to impact.

STEP 01

Obtain local shell as unprivileged user

The attacker needs a low-privilege shell on a Linux host running a vulnerable kernel (4.14 – 7.1-rc6). This could come from compromised credentials, an application-layer RCE, or a malicious insider. No network-facing exposure is required for the kernel bug itself.

Conditions required:

Low-privilege local shell on target host
Kernel version in vulnerable range (4.14 – 7.1-rc6)

Where this breaks in practice:

Requires prior initial access — this is a post-compromise escalation, not an entry vector

Detection/coverage: EDR agents with process-lineage telemetry should flag unusual shell spawns; SSH audit logs capture credential-based access.

STEP 02

Verify prerequisite kernel configs

The attacker checks that unprivileged user namespaces are enabled (sysctl kernel.unprivileged_userns_clone or /proc/sys/user/max_user_namespaces > 0) and that CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER are compiled into the kernel or loaded as modules. On RHEL 9, Ubuntu 22.04+, and Debian 12+, all three are enabled by default.

Conditions required:

Unprivileged user namespaces enabled
CONFIG_NET_ACT_GACT built or loaded
CONFIG_NET_CLS_FLOWER built or loaded

Where this breaks in practice:

Hardened hosts that disable unprivileged user namespaces (e.g., kernel.unprivileged_userns_clone=0) block the entire chain
Custom-compiled minimal kernels may omit the tc modules

Detection/coverage: Auditd rules on unshare(CLONE_NEWUSER) syscalls can detect namespace creation attempts.

STEP 03

Create user + network namespace and set up tc races

Using the STAR Labs exploit (public on GitHub at star-sg/CVE/CVE-2026-53264), the attacker creates a user namespace, then a network namespace inside it, gaining CAP_NET_ADMIN within that namespace. They then issue concurrent NEWTFILTER and DELFILTER netlink messages to trigger the race on the tc_action object.

Conditions required:

Ability to create user namespace (CAP_SYS_ADMIN not required when unprivileged userns is enabled)

Where this breaks in practice:

The race window is tight — the published exploit needed 9–111 seconds across runs, meaning it is noisy and involves repeated syscalls that generate telemetry

Detection/coverage: Kernel audit subsystem and Falco/Tetragon can detect rapid tc netlink operations from non-root users inside new namespaces. Sysdig or eBPF-based agents can flag the pattern.

STEP 04

Reclaim freed slab object with controlled data

After the tc_action is freed, the attacker sprays the same slab cache with attacker-controlled objects (e.g., msg_msg or pipe_buffer) to reclaim the freed memory. The dangling pointer in the tc path now points to attacker-controlled data, giving a kernel read/write primitive.

Conditions required:

Kernel heap layout must be predictable enough for slab reclaim

Where this breaks in practice:

Slab randomization (CONFIG_SLAB_FREELIST_RANDOM) and AUTOSLAB (merged in 6.12+) reduce spray reliability
KASAN-enabled debug kernels will detect the UAF and panic instead of exploiting

Detection/coverage: KASAN (if enabled) generates a splat in dmesg. Production kernels typically do not run KASAN.

STEP 05

ROP chain to root

With an arbitrary kernel write, the attacker overwrites cred structures or modifies task_struct to escalate to UID 0. The published exploit uses a ROP chain with hardcoded offsets for the CentOS Stream 9 kernel; different distros/versions require offset recalculation but this is a mechanical exercise given debug symbols.

Conditions required:

Knowledge of kernel symbol offsets (available from /proc/kallsyms if kptr_restrict=0, or from distro debug packages)

Where this breaks in practice:

KASLR requires an info leak or brute force to locate gadgets — the published exploit handles this for CentOS 9 but would need adaptation per-distro
SMEP/SMAP prevent trivial userspace code execution from kernel context

Detection/coverage: EDR agents monitoring for setuid(0) from non-root processes or unexpected credential changes can catch the final escalation step.

STEP 06

Post-exploitation as root

With root on the host, the attacker can install persistence, dump credentials, pivot to other hosts, access container runtimes, or — on a hypervisor — interact with guest VMs. On CI/CD runners, root access enables supply-chain poisoning of build artifacts.

Conditions required:

Successful privilege escalation from step 5

Where this breaks in practice:

Immutable / read-only root filesystems (e.g., Flatcar, Bottlerocket, CoreOS) limit persistence options

Detection/coverage: File integrity monitoring, EDR, and container runtime security (Falco, Tetragon) detect post-exploitation activity.

03 · Compensating Control

Disable unprivileged user namespaces — Set sysctl kernel.unprivileged_userns_clone=0 or sysctl user.max_user_namespaces=0 (depending on distro). This breaks the exploit's ability to obtain CAP_NET_ADMIN inside a namespace, killing the chain at step 2. Deploy within 30 days per noisgate mitigation SLA for HIGH. Note: this may break Flatpak, Podman rootless, Chrome sandboxing — test in staging first.

Unload or blacklist tc action modules — If traffic control actions are not used, blacklist act_gact and cls_flower kernel modules via /etc/modprobe.d/. This removes the vulnerable code path entirely. Deploy within 30 days.

Enable kernel lockdown or kptr_restrict=2 — Set kernel.kptr_restrict=2 to hide kernel symbol addresses from unprivileged users, forcing the attacker to brute-force KASLR. Not a complete fix but raises exploit cost. Also consider lockdown=integrity on supported kernels.

Deploy eBPF-based runtime detection — Use Falco, Tetragon, or Tracee rules to alert on rapid tc netlink operations from non-root users inside new user namespaces. This detects exploitation attempts in near-real-time.

What doesn't work

Network firewalls / WAF / IDS — This is a local privilege escalation; no network traffic is involved in the exploit itself. Perimeter controls are irrelevant.
SELinux in targeted mode — The default RHEL targeted policy does not restrict tc netlink operations or user namespace creation for confined users. A custom policy could help but is not the default.
Container isolation alone — While containers limit the initial blast radius, the exploit targets the *host kernel*. If the container runtime allows user namespace creation (common in rootless setups), the exploit can escalate to host root.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	No evidence of active exploitation as of 2026-08-05. Not listed in CISA KEV.
Proof of Concept	Public and weaponized. STAR Labs (researcher Lee Jia Jie) published full exploit source at star-sg/CVE/CVE-2026-53264. 10/10 success rate on CentOS Stream 9 in 9–111 seconds. Kyle Zeng (KyleBot) independently reported the bug.
EPSS	0.00205 (≈ top 15–20 percentile). Low probability of mass exploitation, consistent with local-only attack vector.
KEV Status	Not listed as of 2026-08-05.
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` — Local access, low complexity, low privilege, no user interaction. Full CIA impact but scope unchanged (no hypervisor escape modeled in the vector).
Affected Versions	Linux kernel 4.14 through 7.1-rc6. Essentially every maintained kernel branch for the past 9 years.
Fixed Versions	Upstream commit `5057e1aca011`. Stable backports: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, 7.1-rc7+. Ubuntu, Debian, SUSE patches pending on some branches; RHEL 9 fix available.
Scanning / Exposure	Local-only bug — no Shodan/Censys/GreyNoise exposure surface. Exposure is every Linux host with vulnerable kernel + default configs. Enterprise kernel audit via package manager is the detection method.
Disclosure Timeline	Upstream fix landed 2026-06-01. CVE published 2026-06-25. STAR Labs exploit published ~2026-07-21. Ubuntu/Debian/SUSE patches still rolling out.
Reporter	Kyle Zeng (KyleBot) reported to upstream. Lee Jia Jie (STAR Labs SG) independently discovered and published the weaponized exploit.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (7.8/10)

Why this verdict

Public weaponized exploit with high reliability: STAR Labs published full source achieving 10/10 root shells in 9–111 seconds on CentOS Stream 9. Adapting to other distros is a mechanical offset-finding exercise given debug symbol packages.
Default configs satisfy all prerequisites: CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER, and unprivileged user namespaces are enabled by default on RHEL 9, Ubuntu 22.04+, Debian 12+, and SUSE 15 SP5+. The vast majority of enterprise Linux hosts are vulnerable out of the box.
Massive affected version range: Every kernel from 4.14 to 7.1-rc6 — nine years of releases — is vulnerable. Patching stragglers will exist for months.
Role multiplier: The Linux kernel is the canonical high-value-role component. On KVM hypervisors, root = access to all guest VMs (fleet-scale blast radius). On container hosts (Kubernetes nodes, Docker hosts), root = container escape and lateral movement across all pods. On CI/CD runners, root = supply-chain poisoning of build artifacts. On production database servers, root = full data exfiltration. ≥10% of Linux installs serve these high-value roles by definition, establishing a HIGH floor.
No in-the-wild exploitation yet: Despite the public exploit, no KEV listing and no campaign reports as of 2026-08-05. This prevents an upgrade to CRITICAL.

Why not higher?

CRITICAL would require either remote exploitability or active in-the-wild exploitation at scale. This bug requires local access (AV:L) — the attacker must already have a shell on the target host, which is a significant prerequisite that compounds with initial-access friction. The scope is unchanged (S:U), meaning the CVSS model does not account for hypervisor escape, and no demonstrated cross-boundary escape has been published.

Why not lower?

A downgrade below HIGH is blocked by the role-multiplier floor: the Linux kernel is definitionally a high-value-role component, and root access on hypervisors, container hosts, and CI runners produces fleet-scale or supply-chain-scale impact. The public, reliable exploit eliminates any complexity-based friction discount. Disabling unprivileged user namespaces is a viable compensating control but is not the default state, so it cannot justify a population-based downgrade.

06 · Verification

Crowdsourced verification payload.

Run this script on each target Linux host as any user (no root required). It checks kernel version against known-fixed versions, verifies prerequisite configs, and reports VULNERABLE, PATCHED, or UNKNOWN. Example: chmod +x check_cve_2026_53264.sh && ./check_cve_2026_53264.sh

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash\n# check_cve_2026_53264.sh — CVE-2026-53264 exposure check\n# Run on target Linux host. No root required.\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nset -euo pipefail\n\nKERNEL=$(uname -r)\nVERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\\.[0-9]+\\.[0-9]+')\n\nif [ -z "$VERSION" ]; then\n  echo "UNKNOWN — could not parse kernel version from: $KERNEL"\n  exit 2\nfi\n\nMAJOR=$(echo "$VERSION" | cut -d. -f1)\nMINOR=$(echo "$VERSION" | cut -d. -f2)\nPATCH=$(echo "$VERSION" | cut -d. -f3)\n\n# Known-fixed stable versions\nis_fixed=0\nif [ "$MAJOR" -lt 4 ]; then\n  # Kernels before 4.14 are not affected\n  is_fixed=1\nelif [ "$MAJOR" -eq 4 ] && [ "$MINOR" -lt 14 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 10 ] && [ "$PATCH" -ge 259 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 15 ] && [ "$PATCH" -ge 210 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 176 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 6 ] && [ "$PATCH" -ge 143 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 12 ] && [ "$PATCH" -ge 94 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 18 ] && [ "$PATCH" -ge 36 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 0 ] && [ "$PATCH" -ge 13 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -ge 1 ]; then\n  is_fixed=1\nelif [ "$MAJOR" -ge 8 ]; then\n  is_fixed=1\nfi\n\nif [ "$is_fixed" -eq 1 ]; then\n  echo "PATCHED — kernel $KERNEL is at or above a fixed version for CVE-2026-53264."\n  exit 0\nfi\n\n# Check prerequisites\nUSERNS=0\nif [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then\n  USERNS=$(cat /proc/sys/kernel/unprivileged_userns_clone)\nelif [ -f /proc/sys/user/max_user_namespaces ]; then\n  MAX_USERNS=$(cat /proc/sys/user/max_user_namespaces)\n  [ "$MAX_USERNS" -gt 0 ] && USERNS=1\nelse\n  # If neither sysctl exists, assume enabled (common default)\n  USERNS=1\nfi\n\nGACT=0\nif modinfo act_gact &>/dev/null || grep -q CONFIG_NET_ACT_GACT=y /boot/config-"$KERNEL" 2>/dev/null; then\n  GACT=1\nfi\n\nFLOWER=0\nif modinfo cls_flower &>/dev/null || grep -q CONFIG_NET_CLS_FLOWER=y /boot/config-"$KERNEL" 2>/dev/null; then\n  FLOWER=1\nfi\n\necho "Kernel:       $KERNEL (VULNERABLE version range)"\necho "Unprivileged user namespaces: $([ $USERNS -eq 1 ] && echo ENABLED || echo DISABLED)"\necho "CONFIG_NET_ACT_GACT:          $([ $GACT -eq 1 ] && echo PRESENT || echo ABSENT)"\necho "CONFIG_NET_CLS_FLOWER:        $([ $FLOWER -eq 1 ] && echo PRESENT || echo ABSENT)"\n\nif [ "$USERNS" -eq 1 ] && [ "$GACT" -eq 1 ] && [ "$FLOWER" -eq 1 ]; then\n  echo ""\n  echo "VULNERABLE — kernel $KERNEL is in the affected range and all exploit prerequisites are met."\n  exit 1\nelse\n  echo ""\n  echo "VULNERABLE — kernel is in the affected range but one or more exploit prerequisites are missing."\n  echo "Exploitation risk is reduced but patching is still required."\n  exit 1\nfi