Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
A researcher, Lee Jia Jie, has developed a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264, is a use-after-free race in the kernel's network traffic-control subsystem. AI assist…
Intelligence analysis by Llama
A Linux kernel exploit has been developed that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The exploit uses a use-after-free race in the kernel's network traffic-control subsystem. AI assisted with the development of the exploit.
Imagine you have a special kind of superpower that lets you become the boss of a computer. That's basically what this exploit does, but it's only for Linux computers and it requires a special setup. AI helped the person who created this exploit to find the bug and make it work faster.
Analysis
A $60B Vote of Confidence
Lee Jia Jie, a researcher, has developed a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264, is a use-after-free race in the kernel's network traffic-control subsystem. AI assisted with vulnerability discovery, production of a Kernel Address Sanitizer (KASAN) proof of concept, and optimisation of the race window.
The exploit creates its own user and network namespaces, giving it namespace-local CAP_NET_ADMIN without requiring host administrator rights. It reaches the vulnerable path through a clsact qdisc and flower filter. Timerfd and epoll operations widen the race window, while key payload allocations reclaim the freed object. The ROP chain then overwrites core_pattern. The exploit places a copy of itself in a memfd and deliberately crashes a child process, causing Linux to run the memfd-backed binary as the root core-dump handler in the initial namespace.
The upstream patch fixes the race by deferring the free operation until existing read-copy-update (RCU) readers have finished. The exploit's fixed gadget offsets also mean it must be rebuilt for other kernel packages and may not be adaptable to some newer builds. The practical risk is narrower than a generic "Linux root exploit" label may suggest, but public exploit code raises the urgency for compatible systems that remain unpatched.
Why Cursor?
The vulnerability sits in the lifecycle handling of Linux traffic-control actions. Concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one thread reading an action object after another thread has freed it. The upstream patch fixes the race by deferring the free operation until existing read-copy-update (RCU) readers have finished.
The Road Ahead
The Linux CNA record lists vulnerable ranges beginning with Linux 4.14. Fixed releases are 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13, with the mainline fix entering 7.1-rc7. Linux users should install a distribution kernel carrying the fix rather than rely on the upstream version number alone.
Key points
- A Linux kernel exploit has been developed that turns an ordinary local user into root on the CentOS Stream 9 build it targeted.
- The exploit uses a use-after-free race in the kernel's network traffic-control subsystem.
- AI assisted with vulnerability discovery, production of a Kernel Address Sanitizer (KASAN) proof of concept, and optimisation of the race window.
- The exploit creates its own user and network namespaces, giving it namespace-local CAP_NET_ADMIN without requiring host administrator rights.
- The upstream patch fixes the race by deferring the free operation until existing read-copy-update (RCU) readers have finished.
The fact that AI was used to develop the exploit highlights the potential risks and challenges associated with the increasing use of AI in security research. However, the use of AI in this case also demonstrates the potential benefits of AI in security research, such as the ability to analyze large amounts of data and identify potential vulnerabilities.
The public release of the exploit code raises the urgency for compatible systems that remain unpatched. The fact that AI was used to develop the exploit also highlights the potential risks and challenges associated with the increasing use of AI in security research.
