{"id":2040,"date":"2026-07-28T10:40:54","date_gmt":"2026-07-28T10:40:54","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2040"},"modified":"2026-07-28T10:40:54","modified_gmt":"2026-07-28T10:40:54","slug":"researcher-says-ai-helped-develop-linux-traffic-control-race-into-root-exploit","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2040","title":{"rendered":"Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Jul 28, 2026<\/span><\/span>Vulnerability \/ Linux<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

STAR Labs has published a Linux kernel exploit that turns an ordinary local user into root on the CentOS Stream 9 build it targeted. The flaw, tracked as CVE-2026-53264<\/code> (CVSS score: 7.8), is a use-after-free race in the kernel’s network traffic-control subsystem.<\/p>\n

Researcher Lee Jia Jie said artificial intelligence (AI) helped him find the bug and speed up exploit development. This is local privilege escalation, not remote code execution, so an attacker needs a foothold on the machine before any of it applies.<\/p>\n

The demonstrated exploit also requires unprivileged user namespaces, the CONFIG_NET_ACT_GACT<\/code> and CONFIG_NET_CLS_FLOWER<\/code> kernel options, and a kernel-specific return-oriented programming (ROP) chain containing hardcoded offsets. Those conditions narrow the immediate exposure, but full exploit source code is now public.<\/p>\n

The upstream fix landed on June 1, 2026, and has since been backported to several stable kernel branches. The Linux CNA record<\/a> lists vulnerable ranges beginning with Linux 4.14. Fixed releases are 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, and 7.0.13, with the mainline fix entering 7.1-rc7.<\/p>\n

Linux users should install a distribution kernel carrying the fix rather than rely on the upstream version number alone. The Hacker News found no entry for the flaw in CISA’s Known Exploited Vulnerabilities catalog<\/a> and no official report of exploitation in the wild as of July 28, 2026.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Lee said in a technical write-up<\/a> that AI assisted with vulnerability discovery, production of a Kernel Address Sanitizer (KASAN) proof of concept, and optimisation of the race window. STAR Labs also released the CentOS-targeted exploit code<\/a>.<\/p>\n

Without the model, prompts, service, or interaction record, the disclosure is difficult to use as a benchmark of AI capability or to separate the system’s contribution from Lee’s direction and judgement.<\/p>\n

The Hacker News asked STAR Labs for details on the AI system, test environment, and disclosure timeline and will update this story with any response.<\/p>\n

\u00abAI still has many blind spots and lapses in reasoning ability,\u00bb Lee said, adding that human judgement remained necessary throughout the work.<\/p>\n