Full research report

Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-53264 is a real and credibly exploitable Linux kernel local privilege-escalation flaw with a public, compilable exploit, but its threat is substantially bounded: it demands local access, enabled unprivileged user namespaces, two specific kernel build options, and a kernel-version-specific ROP chain that must be rebuilt per target. Distribution patch coverage is incomplete as of 28 July 2026, making CentOS Stream 9 and unpatched Ubuntu and SUSE installs with those namespace conditions the most immediately at-risk population. The AI-assistance narrative is notable but unverifiable without system identification; what matters operationally is that the exploit works and is public. CVE-2026-50522 is a distinct, higher-urgency story: a critical SharePoint RCE with confirmed in-the-wild exploitation since at least 17 July 2026, an accessible public PoC, CISA KEV listing, and attacker TTPs extending to machine-key extraction that patching alone does not remediate. The large divergence in EPSS scores (0.57 for SharePoint versus 0.00121 for the Linux flaw) accurately reflects the current operational exploitation gap between the two vulnerabilities.

What happened

On 27 July 2026, STAR Labs researcher Lee Jia Jie published a full local privilege-escalation exploit and technical write-up for CVE-2026-53264, a use-after-free race condition in the Linux kernel's net/sched traffic-control subsystem. The upstream fix was merged on 1 June 2026, but distribution kernel coverage remained incomplete as of 28 July 2026. The source material separately includes CVE-2026-50522, a critical Microsoft SharePoint deserialization flaw patched on 14 July 2026 whose active in-the-wild exploitation was confirmed from 17 July 2026 and which was added to the CISA Known Exploited Vulnerabilities catalogue on 22 July 2026.

Affected scope

CVE-2026-53264 affects Linux kernel versions from approximately 4.14 through 7.0.12 and 7.1-rc1 to rc6, on hosts with unprivileged user namespaces and CONFIG_NET_ACT_GACT plus CONFIG_NET_CLS_FLOWER enabled. Debian has issued fixed packages; Ubuntu and SUSE still list multiple maintained kernel packages as vulnerable as of 28 July 2026. CVE-2026-50522 affects SharePoint Enterprise Server 2016, Server 2019, and Subscription Edition deployed on-premises.

Technical assessment

CVE-2026-53264 is a use-after-free race in tcf_idr_check_alloc(): concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one execution path reading a freed traffic-control action object. The upstream patch defers the free until RCU readers quiesce, eliminating the race window. Exploitation requires a user namespace for namespace-scoped CAP_NET_ADMIN, specific kernel build options, and a kernel-version-specific ROP chain with hardcoded offsets—meaning the published exploit targets CentOS Stream 9 specifically and must be ported to other builds. CVE-2026-50522 is a deserialization flaw in SharePoint's federation trust endpoint; an authenticated site owner can deliver a malicious serialised payload to achieve remote code execution, and post-exploitation attackers are observed extracting machine keys to maintain persistent access.

Recommended defensive actions

  1. Patch Linux kernels to fixed versions 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13; verify distribution package versions rather than relying on upstream version numbers alone
  2. Restrict unprivileged user namespace creation on Linux hosts where the kernel patch cannot be applied immediately, as this blocks the primary privilege-required prerequisite for CVE-2026-53264
  3. Apply the July 2026 Patch Tuesday updates for all three on-premises SharePoint editions to remediate CVE-2026-50522
  4. Rotate machine keys and credentials on any SharePoint servers that were internet-accessible prior to patching, as exploitation enables persistent machine-key extraction
  5. Monitor Linux hosts for unexpected creation of user or network namespaces by unprivileged accounts, and monitor SharePoint servers for anomalous POST requests to federation trust endpoints

Uncertainties and evidence gaps

  • The AI system used by Lee Jia Jie has not been identified by STAR Labs; the AI's actual contribution cannot be independently separated from the researcher's own direction and judgement
  • The exploit's claimed reliability figures (10 of 10 runs, 9–111 seconds on a laptop) have not been independently reproduced; performance on other kernel builds is unstated
  • The proportion of deployed Linux systems meeting all required namespace and kernel-option prerequisites is not established in public sources
  • No exploitation of CVE-2026-53264 in the wild has been reported, but the time between public PoC availability and weaponisation in broader attacks is unknown
  • The full scope of SharePoint instances compromised via CVE-2026-50522 before detection and CISA notification has not been publicly disclosed

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessLocal authenticated user with unprivileged user namespace creation rights on the target host
ComponentLinux kernel net/sched subsystem; tcf_idr_check_alloc() traffic-control action index-radix tree
MechanismUse-after-free race condition: one thread may dereference a freed traffic-control action object during concurrent filter creation and deletion operations because the free path does not wait for RCU readers to finish
ImpactFull kernel code execution yielding root privilege on the affected host
DetectionKernel KASAN or KCSAN instrumentation may report use-after-free or data-race warnings; unexpected unprivileged creation of user or network namespaces is an observable precondition in host logs
MitigationApply kernel patch (deferred RCU-based freeing in net/sched, commit 5057e1aca011e51ef51498c940ef96f3d3e8a305); disable unprivileged user namespace creation as an interim control where patching is delayed
Exploitation status

CVE-2026-53264 (this story): no confirmed active exploitation or CISA KEV entry as of 28 July 2026; full exploit source code is public as of 27 July 2026. CVE-2026-50522 (Microsoft SharePoint, separately included in source material): exploitation in the wild was confirmed from 17 July 2026 and the entry was added to the CISA Known Exploited Vulnerabilities catalogue on 22 July 2026.

Research process

Investigation began with two distinct items in the source material: the headline about an AI-assisted Linux kernel local privilege-escalation exploit (CVE-2026-53264) and a CISA KEV entry for a Microsoft SharePoint RCE (CVE-2026-50522). Parallel searches identified the STAR Labs blog post and GitHub repository as primary sources for the Linux story, the NVD record established the authoritative version range, and Infosecurity Magazine provided independent corroboration. For SharePoint, The Hacker News and SecurityWeek independently confirmed exploitation, machine-key theft, and the CISA KEV addition; the CISA alert page returned a 403 and was therefore excluded from citations, with its substance confirmed via the two independent outlets.

  1. What is CVE-2026-53264 and has STAR Labs published the claimed exploit?
    Searched for CVE-2026-53264 Linux kernel traffic control exploit 2026

    CVE-2026-53264 is a use-after-free in net/sched; STAR Labs blog post and GitHub exploit repository identified as primary sources; Infosecurity Magazine and GBHackers identified as independent secondary sources

    why Established the event, confirmed a primary researcher source exists, and identified URLs to verify

  2. What is CVE-2026-50522 and is there confirmed active exploitation backing the CISA KEV entry?
    Searched for CVE-2026-50522 Microsoft SharePoint CISA KEV 2026

    Critical SharePoint deserialization flaw, CVSS 9.8; CISA KEV entry 22 July 2026; active exploitation confirmed; multiple independent outlets (THN, SecurityWeek, SecurityAffairs) covering the story

    why Confirmed the CISA KEV entry from the source material is real and exploitation is verified, establishing it as a distinct high-urgency story

  3. Does the STAR Labs blog post confirm AI-assistance claims and technical exploitation prerequisites?
    Fetched https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/
    starlabs.sg ↗

    Blog confirmed; AI assisted with bug discovery, KASAN PoC, and race-window optimisation; researcher is Lee Jia Jie (@mkofdwu); CVE was also independently reported by KyleBot two days before TyphoonPwn 2026; exploit requires unprivileged namespaces and specific kernel options

    why Verified the primary source's claims, established authorship, and confirmed exploitation prerequisites for defender guidance

  4. Is the exploit code publicly available at the cited GitHub repository?
    Fetched https://github.com/star-sg/CVE/tree/master/CVE-2026-53264
    github.com ↗

    Repository confirmed; contains poc.c, pwn_utils files, Makefile, and KASLR-bypass utilities consistent with a compilable kernel privilege-escalation exploit

    why Confirmed exploit code is publicly accessible, establishing the operational urgency for unpatched systems

  5. What is the authoritative affected-version range and patch status per NVD?
    Fetched https://nvd.nist.gov/vuln/detail/CVE-2026-53264
    nvd.nist.gov ↗

    CVSS 7.8 High (AV:L/AC:L/PR:L/UI:N); CWE-416; affects Linux 4.14 through 7.0.12 and 7.1-rc1 to rc6; eight patch commits; published 25 June 2026

    why Established the definitive version range and CVSS vector from a primary authoritative registry, enabling precise patch-status defender guidance

  6. Does Infosecurity Magazine independently corroborate the CVE-2026-53264 technical details?
    Fetched https://www.infosecurity-magazine.com/news/ai-linux-kernel-zero-day-net-sched/
    infosecurity-magazine.com ↗

    Independently confirmed: net/sched UAF, AI-assisted race optimisation (reducing attack time significantly), TyphoonPwn 2026 context, local-only exploitation requirement, and CentOS Stream 9 targeting

    why Provided the required independent corroboration on a separate domain for the Linux kernel story

  7. What exploitation details and attacker TTPs are confirmed for CVE-2026-50522?
    Fetched https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html
    thehackernews.com ↗

    Confirmed active exploitation; attackers extracting machine keys; public PowerShell PoC from Janggggg; discovered by DEVCORE researcher splitline; fourth SharePoint flaw exploited in July 2026 wave; remediation deadline 25 July for FCEB agencies

    why Established exploitation mechanism, post-exploitation TTP, and PoC attribution for the SharePoint story

  8. Does SecurityWeek independently confirm the exploitation timeline and CISA KEV addition?
    Fetched https://www.securityweek.com/fourth-sharepoint-vulnerability-exploited-in-past-months-wave-of-attacks/
    securityweek.com ↗

    Confirmed honeypot detection 17 July, WatchTowr in-the-wild confirmation 21 July, CISA KEV addition 22 July, and broader wave context (13 total SharePoint KEV entries, five added in 2026); WatchTowr advises credential rotation beyond patching

    why Second independent domain corroborating the SharePoint exploitation story and adding the credential-rotation defensive recommendation

Named in this story
ActorsLee Jia Jie / @mkofdwu (STAR Labs)Kyle Zeng / KyleBot (original CVE-2026-53264 reporter)splitline (DEVCORE, CVE-2026-50522 discoverer)Janggggg (CVE-2026-50522 public PoC author)WatchTowr (SharePoint exploitation confirmation)
TargetsLinux systems with unprivileged user namespaces and net/sched traffic-control options enabledMicrosoft SharePoint on-premises: Enterprise Server 2016, Server 2019, Subscription Edition
Related CVEs CVE-2026-53264CVE-2026-50522

Research coverage

All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1655 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok11 records Primary evidence1 matched items Published the source report used to frame and date the event.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok7121 records Context2 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok666 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Rapid7news ok5 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sophos IOCsresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation3
CVE-2026-50522 CISA KEV Microsoft SharePoint · added 2026-07-22 CISA catalog ↗
CVE-2026-50522 EPSS 57.1% 99th percentile exploitation probability
CVE-2026-53264 EPSS 0.1% 2th percentile exploitation probability
Reporting-linked PoC claims1
https://github.com/star-sg/CVE/tree/master/CVE-2026-53264 github.com ↗

Linked by reporting but not validated as PoC by the configured exploit indexes.

PoC & exploit code1
STAR Labs – CVE-2026-53264 Exploit Repository (GitHub) github.com ↗

Full exploit source code targeting CentOS Stream 9; contains ROP-chain utilities, KASLR-bypass code, and privilege-escalation payload

Vendor & gov advisories1
NVD – CVE-2026-53264 nvd.nist.gov ↗

CVSS 7.8 High (AV:L/AC:L/PR:L/UI:N); CWE-416; lists affected kernel version ranges from 4.14 through 7.0.12 and eight patch commits via kernel.org; published 25 June 2026

Analysis & research4
When AI Makes 0-Days Feel Like N-Days – STAR Labs Blog starlabs.sg ↗

Primary technical write-up by Lee Jia Jie: details AI-assisted bug discovery, KASAN PoC generation, race-window optimisation, and full exploitation methodology for CVE-2026-53264

AI-Assisted Bug Hunt Uncovers Linux Kernel 0-Day in net/sched – Infosecurity Magazine infosecurity-magazine.com ↗

Independent secondary reporting corroborating the net/sched UAF, AI contribution detail, and TyphoonPwn 2026 competition context

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC – The Hacker News thehackernews.com ↗

Confirms active exploitation, public PowerShell PoC, machine-key theft post-exploitation, and DEVCORE researcher attribution for CVE-2026-50522

Fourth SharePoint Vulnerability Exploited in Past Month's Wave of Attacks – SecurityWeek securityweek.com ↗

Independently confirms exploitation timeline (17–21 July), CISA KEV addition 22 July, and broader wave of four SharePoint flaws exploited in July 2026