Loading story…
STAR Labs publicly disclosed CVE-2026-53264, a Linux kernel local privilege escalation flaw in the net/sched traffic-control subsystem, and released exploit details showing how an unprivileged local user can obtain root access under specific conditions. The bug stems from a use-after-free race in tcf_idr_check_alloc(), where action objects can be freed during lookup because of a lock and RCU mismatch. The researcher demonstrated reliable exploitation on CentOS Stream 9 by racing RTM_NEWTFILTER and RTM_DELTFILTER, reclaiming freed tc_action objects, and ultimately overwriting core_pattern to execute code as root.
The write-up said exploitation depends on factors including enabled unprivileged user namespaces and relevant net/sched components such as clsact and flower, with additional techniques used to improve reliability, including an EntryBleed kASLR leak and race optimization with timerfd and epoll. Researcher Lee Jia Jie said AI helped identify the bug, generate a KASAN proof of concept, and refine exploit reliability, although human validation remained essential. The upstream patch landed on June 1 and was backported to several stable branches, but distribution-level patch coverage was still uneven, and no confirmed in-the-wild exploitation had been reported.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
STAR Labs publicly disclosed CVE-2026-53264, a use-after-free race in the Linux traffic-control subsystem, along with exploit code and technical details showing reliable local root exploitation under specific conditions. The writeup says the bug was assigned CVE-2026-53264 and patched, and describes exploitation against CentOS Stream 9 for TyphoonPwn 2026.
The upstream patch for the Linux kernel local privilege escalation flaw CVE-2026-53264 landed on June 1, 2026. The fix was also backported to multiple stable branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcethehackernews.com
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. **CVE-2026-23111** affects the `nftables` subsystem and stems from an inverted conditional in `nft_map_catchall_activate()` that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake `nft_expr_ops` structure, and executing a ROP chain that calls `commit_creds(&init_cred)`. The exploit also uses `switch_task_namespaces()` to break out of namespaces and containers. A separate flaw, **CVE-2026-23412**, affects the Linux kernel’s BPF netfilter link implementation in `nf_bpf_link.c`, where synchronous deallocation of `bpf_nf_link_lops` allowed concurrent `nfnetlink` hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in `nfnl_hook_dump_one` on kernel `6.14.0` and said the bug could be exploited through heap spraying and function-pointer hijacking in the `kmalloc-192` slab cache. The issue was introduced in `6.4-rc1` and fixed in `7.0-rc5` by commit `24f90fa3994b`, which switches to RCU-deferred freeing, while the `nftables` bug was patched upstream by commit `f41c5d1`; administrators were urged to deploy patched kernels promptly.
Jun 29, 2026
Researchers detailed exploitation of **CVE-2023-31248** in the Linux kernel's `nftables` subsystem, showing how a chain lookup flaw can let local attackers gain root privileges. The bug exists because `nft_chain_lookup_byid` did not verify whether a chain was still active through `genmask` checks, allowing rules in a batch transaction to reference chains deleted in the same batch. That logic error can trigger a **use-after-free** when rule deletion in the control plane races with asynchronous transaction-worker cleanup, creating a path to reclaim freed memory and corrupt kernel objects. The write-up demonstrates an exploit on **Ubuntu 23.04** with kernel `6.2.0-20-generic`, using heap sprays and information leaks to recover kernel text and heap addresses before forging `nftables` structures and building a ROP chain that invokes `prepare_kernel_cred` and `commit_creds` to obtain a root shell. Researchers said kernels before `6.2.0-26-generic` were vulnerable, while upstream fixes added `genmask` validation to chain-by-ID lookups so inactive chains cannot be referenced. The same research also described a separate dormant-state chain hook deactivation bug that can trigger kernel warnings but was assessed as not practically exploitable and patched by blocking repeated dormant-state toggles within a single batch.
Jun 29, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Jul 11, 2026