Loading vulnerability…
CVE-2026-53264 is a local privilege escalation vulnerability in the Linux kernel net/sched packet scheduling subsystem, specifically the action lifecycle handling in act_api. The flaw is a use-after-free caused by a race between concurrent filter creation and deletion paths. During action lookup, code such as tcf_idr_check_alloc() accesses an action object from the IDR under RCU read-side protection, but the delete path could remove the object and free it immediately after its reference count reached zero, without deferring reclamation until the end of an RCU grace period. This creates a window in which another thread can still hold or obtain a stale pointer and then attempt to increment the reference count on already freed memory. The upstream fix restores RCU-safe deferred freeing by adding RCU-based reclamation for tc_action objects and using call_rcu()/kfree_rcu() semantics in the delete path so the final free occurs only after existing readers have quiesced.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel local privilege escalation zero-day in the net/sched packet scheduling subsystem caused by a use-after-free race condition in tcf_idr_check_alloc(), allowing local attackers to gain root privileges under specific conditions.
A Linux kernel local privilege escalation vulnerability caused by a use-after-free race in the network traffic-control subsystem, allowing an ordinary local user to gain root under specific conditions.
A Linux kernel net/sched use-after-free race condition caused by a lock/RCU mismatch in action lookup and free paths, enabling local privilege escalation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.