A years-old Linux kernel flaw allowing local privilege escalation to root has been disclosed after AI-assisted research uncovered a race condition in net/sched.
In new research published July 27, Lee Jia Jie of Singapore offensive security firm STAR Labs said he found the use-after-free during an internship, his first Linux kernel work.
It is tracked as CVE-2026-53264.
Race Condition Exposes Freed Kernel Object
Net/sched controls when and how network packets are transmitted. The flaw stems from mismatched locking around a shared data structure: one function reads entries under a Read-Copy-Update (RCU) lock, while another path can free an entry without waiting for the RCU grace period.
That gap creates a race window in which the kernel may continue using an object after its memory has been released. Successful abuse could give a local unprivileged user root access, but requires unprivileged user namespaces and two supporting kernel options. Testing targeted a CentOS Stream 9 desktop.
Read more on Linux kernel flaws: CrackArmor Flaws Expose Linux Systems to Privilege Escalation
Jia Jie used AI to identify the bug, produce a crash proof and improve the reliability of triggering the race. Separately, optimization reduced the time required to hit the condition from more than 15 minutes to about five seconds.
The result follows previous Google OSS-Fuzz work using AI to expose hidden flaws in open-source projects.
Competition Miss and Wider Kernel Findings
The exploit was prepared for TyphoonPwn 2026’s Linux local privilege escalation category, which offered prizes of $70,000, $35,000 and $17,500. Jia Jie drew position eight of 11, but the category closed after three winners, so his entry was never demonstrated.
KyleBot, an AI system, had independently reported the same bug two days before TyphoonPwn 2026. Jia Jie said the defect had existed for two to three years, describing this as evidence that AI can make zero-day work resemble n-day analysis.
He also reported two exploitable flaws in the perf events subsystem. One was assigned CVE-2026-64300; the issues were reachable on Intel bare-metal systems under a permissive performance-monitoring setting, affecting RHEL-based and Arch systems rather than Debian-based distributions, and were mainly relevant to desktop Linux.
Jia Jie said AI accelerated bug hunting but still showed blind spots and reasoning failures. He concluded that detailed subsystem knowledge remains important for finding weaknesses automated systems miss.
CVE-2026-53264 has been patched upstream. The fix defers freeing the affected object until after the RCU grace period, removing the use-after-free window. Linux users and administrators should obtain fixed kernels through their distribution’s security update channels.
