Researcher Publishes Linux Kernel Root Exploit Built With AI Help

Key points

• STAR Labs researcher Lee Jia Jie published a working Linux kernel exploit that hands root access to any local user on CentOS Stream 9.
• The flaw is tracked as CVE-2026-53264 and carries a CVSS severity score of 7.8.
• The bug is a use-after-free race condition in the kernel's network traffic-control subsystem.
• Lee said he used artificial intelligence tools to help find the bug and write the exploit faster.
• The attack requires the attacker to already have a login on the machine. It is not remotely exploitable over the internet.

A security researcher has released a working exploit that turns a normal Linux user into the all-powerful "root" account on a widely used server operating system.

The exploit targets CentOS Stream 9, a free Linux build that many companies use to test software before running it on Red Hat's paid enterprise systems. It was published by Lee Jia Jie of STAR Labs and first reported by The Hacker News.

Root is the top-level account on a Linux machine. Anyone who reaches it can read every file, install any program, and switch off security tools. That is what makes this class of bug serious even when it needs a local login to start.

What is the flaw?

The flaw is a use-after-free race condition in the Linux kernel's traffic-control code, the part of the operating system that decides the order in which network packets are sent. It is tracked as CVE-2026-53264 with a CVSS score of 7.8, which the scale calls "high" severity but not "critical".

A use-after-free is a programming mistake where the software keeps using a chunk of memory after it has already told the system that chunk is free to reuse. A race condition means the bug only shows up when two things happen in a very specific order, very close together in time. Attackers who can trigger both at will can rearrange the freed memory to their liking and, from there, take over the kernel itself.

How did AI help?

Lee said artificial intelligence tools helped him spot the bug in the kernel source code and then speed up writing the exploit itself. He has not published the specific prompts or models used in the writeup released so far.

That detail matters. Kernel exploitation has long been the preserve of a small group of specialists who spend weeks reading code by hand. If AI assistants meaningfully shorten that timeline, defenders should expect more of these local privilege-escalation bugs to surface in public in the months ahead.

Should ordinary users be worried?

Not directly, but system administrators should patch. The bug cannot be triggered by simply visiting a website or opening an email. An attacker needs a working login on the Linux machine first.

The real risk is chaining. A criminal who breaks into a low-privilege service account through a weak password or a separate web flaw could use CVE-2026-53264 to escalate to root and take over the whole server. That is a common pattern in ransomware intrusions, where the initial foothold is boring and the privilege escalation is what turns a nuisance into a company-wide outage.

Administrators running CentOS Stream 9 or related Red Hat Enterprise Linux builds should apply kernel updates from their distribution as soon as those updates land, and restrict who can log in to production Linux hosts in the meantime.

Common questions

Is my home computer affected?

Almost certainly not in any practical way. The exploit targets Linux servers running CentOS Stream 9. Home Windows, macOS, Android and iOS devices are not touched by this specific bug.

Does the AI angle change the defence?

The defence is the same: patch the kernel, limit local accounts, and monitor for unexpected privilege changes. What the AI angle changes is the pace, so patch windows that felt comfortable last year may not feel comfortable this year.