Linux kernel net/sched act_api use-after-free privilege escalation

This repository is a real local privilege-escalation proof-of-concept for CVE-2026-53264 targeting the Linux kernel. The code is concentrated under CVE/CVE-2026-53264/ and consists of a Makefile, the main exploit in poc.c, a KASLR leak helper in dmesg_msr_kaslr.c/.h, and a C++ timing side-channel helper in pwn_utils.cpp/.h. README files at the repository root and under CVE/ provide general project context, while the root README appears templated and not technically relevant to exploit execution. The main exploit logic in poc.c performs local kernel exploitation through Linux traffic-control and netlink primitives. It opens a NETLINK_ROUTE socket, builds and sends rtnetlink messages, and manipulates tc filters/actions, apparently racing add/delete/bind operations across multiple threads. The code uses timerfd and large epoll fan-out to create long interrupt-context stalls, increasing the chance of winning a race in kernel code. It also creates multiple binder/deleter/spray threads and pins them to CPUs, indicating a reliability-focused race exploit rather than a simple crash reproducer. A major capability of the exploit is KASLR bypass. dmesg_msr_kaslr.c first attempts to parse kernel logs for an exception-handler MSR pointer by reading the kernel log buffer via klogctl or falling back to /var/log/dmesg. If that fails, it uses the C++ helper in pwn_utils.cpp to perform a prefetch timing side-channel over candidate kernel base slots and derive the kernel text base by majority vote across trials. This leaked base is then used in poc.c to compute hardcoded gadget and symbol offsets such as STACK_PIVOT, POP_RDI_RET, POP_RSI_RET, POP_RDX_RET, COPY_FROM_USER, POP_RSP_RET, MSLEEP, and CORE_PATTERN, strongly indicating a kernel ROP chain. The exploit also sets up a sandbox/user namespace environment via unshare(CLONE_NEWNS | CLONE_NEWUSER | CLONE_NEWNET) and writes to /proc/self/setgroups, /proc/self/uid_map, and /proc/self/gid_map. This suggests the exploit is intended to run as an unprivileged local user in a namespace-isolated context while still reaching vulnerable kernel paths. The presence of fake_core_pattern set to "|/proc/%P/fd/666 %P" indicates a post-exploitation mechanism involving overwriting or abusing core_pattern to trigger attacker-controlled execution. No external internet endpoints, hardcoded IPs, or remote C2 infrastructure are present. The only meaningful endpoints are local kernel/userland interfaces: /var/log/dmesg, /proc/self/* mapping files, the core_pattern payload path, and the NETLINK_ROUTE kernel interface. Overall, this is an operational local Linux kernel exploit PoC with a built-in KASLR bypass and a concrete payload path, not merely a detector or crash test.