Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Linux kernel traffic-control use-after-free race public exploit privilege-escalation flaw (CVE-2026-53264)

Vulnerability
First reported
Last updated
Happening score
H score 28
1 unique sources, 1 articles

Summary

Hide ▲

Public exploit code for CVE-2026-53264 turns a Linux kernel traffic-control use-after-free race into local privilege escalation to root on affected builds. The demonstrated target was a CentOS Stream 9 system, and the exploit depends on specific kernel options and namespaces, which narrows immediate exposure. Fixed releases are already available across multiple stable branches, but the public code raises patch urgency for any unpatched compatible kernel.

Related Happenings

Linux kernel Dirty Frag local root escalation privilege-escalation flaw

Vulnerability
H score30 First: 08.05.2026 10:45 Last: 08.05.2026 10:45 Sources 1

About this happening: Dirty Frag is a newly disclosed Linux kernel zero-day that can give local attackers root privileges on most major Linux distributions. The flaw is anchored in the...

Open Happening

CISA KEV action for CVE-2026-31431 and FCEB remediation

Public Sector Action
H score37 First: 03.05.2026 09:26 Last: 03.05.2026 09:26 Sources 1

About this happening: CISA added CVE-2026-31431 to its KEV catalog, putting Federal Civilian Executive Branch (FCEB) agencies on notice to remediate an actively exploited Linux privilege-es...

Open Happening

Linux distributions mitigation advisories for CVE-2026-31431

Advisory/Mitigation
H score39 First: 30.04.2026 12:24 Last: 30.04.2026 12:24 Sources 1

About this happening: Multiple Linux distributions released advisories for CVE-2026-31431, adding mitigation guidance for a Linux kernel local privilege escalation that can let an unprivile...

Open Happening

Linux kernel AppArmor confused deputy vulnerabilities CrackArmor security flaw

Vulnerability
H score56 First: 13.03.2026 10:18 Last: 13.03.2026 10:18 Sources 1

About this happening: Researchers disclosed CrackArmor, nine confused deputy flaws in the Linux kernel's AppArmor module that can let unprivileged users bypass protections, gain root*...

Open Happening

Timeline

  2. 28.07.2026 11:04 2 articles · 3h ago

    STAR Labs releases public exploit code for CVE-2026-53264

    Initial Disclosure

    STAR Labs published public exploit code for CVE-2026-53264, a Linux kernel use-after-free race in the traffic-control subsystem, and the demonstrated CentOS Stream 9 build let an ordinary local user reach root. The exploit requires unprivileged user namespaces, CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER, and a kernel-specific ROP chain with hardcoded offsets, and the full source code is now public.

    Show sources
    Open in new tab