Researcher Publishes Linux Kernel Root Exploit Built With AI Help
CVE-2026-53264, a use-after-free flaw in the kernel's traffic-control code, lets an ordinary Linux user gain full system control on CentOS Stream 9.
Key points
- STAR Labs researcher Lee Jia Jie published a working Linux kernel exploit that hands root access to any local user on CentOS Stream 9.
- The flaw is tracked as CVE-2026-53264 and carries a CVSS severity score of 7.8.
- It's a use-after-free race condition in the kernel's network traffic-control subsystem.
- Lee said he used artificial intelligence tools to help find the bug and write the exploit faster.
- The attack requires an existing login on the machine and can't be triggered remotely.
A security researcher has released a working exploit that turns a normal Linux user into the all-powerful "root" account on a widely used server operating system.
Lee Jia Jie of STAR Labs published the exploit targeting CentOS Stream 9, a free Linux build that many companies use to test software before running it on Red Hat's paid enterprise systems. The Hacker News first reported it. Root is the top-level account on a Linux machine: whoever holds it can read every file, install software, and disable security tools, which is what makes this class of bug serious even when a local login is required to start.
What is the flaw?
The vulnerability sits in the kernel's traffic-control code, the subsystem that decides the order in which network packets are sent. CVE-2026-53264 scores 7.8 on the CVSS scale, which the framework calls "high" severity but not "critical".
A use-after-free is a programming mistake where software keeps referencing a chunk of memory after releasing it. The race condition means the bug only surfaces when two operations happen in a precise sequence within a very tight window. Attackers who can trigger both reliably can reshape that freed memory and take over the kernel from there. This is the third traffic-control-adjacent kernel root bug Threat Vectr has covered since late June, following the act_pedit out-of-bounds write and DirtyClone, both published 26 June 2026.
| Detail | Value |
|---|---|
| CVE ID | CVE-2026-53264 |
| CVSS score | 7.8 (High) |
| Affected system tested | CentOS Stream 9 |
| Bug class | Use-after-free race |
| Kernel component | Network traffic control (tc) |
| Access required | Local user account |
How did AI help?
Lee said AI tools helped him spot the bug in the kernel source code and speed up writing the exploit. He hasn't published the specific prompts or models used in the writeup released so far.
That detail matters. Kernel exploitation has long been the preserve of a small group of specialists who spend weeks reading code by hand. If AI assistants meaningfully shorten that timeline, defenders should expect more local privilege-escalation bugs to surface publicly in the months ahead.
Should ordinary users be worried?
Not directly, but system administrators should patch. The bug can't be triggered by visiting a website or opening an email: an attacker needs a working login on the Linux machine first.
The real risk is chaining. A criminal who breaks into a low-privilege service account through a weak password or a separate web flaw could use CVE-2026-53264 to escalate to root and take over the whole server. That's a common pattern in ransomware intrusions, where the initial foothold is unremarkable and the privilege escalation turns a nuisance into a company-wide outage.
Administrators running CentOS Stream 9 or related Red Hat Enterprise Linux builds should apply kernel updates as soon as they land, and restrict who can log in to production Linux hosts in the meantime.
Common questions
Is my home computer affected?
Almost certainly not in any practical way. The exploit targets Linux servers running CentOS Stream 9. Home Windows and macOS devices are not touched by this specific bug.
Does the AI angle change the defence?
The defence is the same: patch the kernel, limit local accounts. What the AI angle changes is pace, so patch windows that felt comfortable last year may not feel comfortable now.
