A years-old flaw in the Linux kernel, which allows local privilege escalation to root, has come to light following an AI-assisted investigation that revealed a race condition in the kernel’s networking scheduler, net/sched. This significant discovery was made public on July 27, 2026, by Lee Jia Jie, a researcher from the Singapore-based offensive security firm STAR Labs. Notably, the vulnerability, tracked as CVE-2026-53264, was identified during Jia Jie’s first internship focused on Linux kernel development.
### Race Condition Exposes Freed Kernel Object
The networking subsystem of the Linux kernel, net/sched, is crucial for managing the timing and transmission of network packets. The recently discovered vulnerability stems from improper locking mechanisms surrounding a shared data structure. Within the kernel, one function is tasked with reading entries while holding a Read-Copy-Update (RCU) lock, yet another pathway is capable of freeing an entry without adhering to the necessary RCU grace period. This discrepancy creates an opportunity—a “race window”—during which the kernel may continue to utilize an object even after its memory has been freed. If successfully exploited, this vulnerability could grant a local unprivileged user root-level access; however, this requires the attacker to have access to unprivileged user namespaces and two specific kernel options. Testing for this flaw was primarily conducted on a CentOS Stream 9 desktop environment.
Lee Jia Jie utilized artificial intelligence not only to detect this bug but also to develop a crash-proof mechanism and enhance the reliability of triggering the race condition. Remarkably, he optimized the process, significantly reducing the time needed to exploit the issue from over 15 minutes to approximately five seconds. This groundbreaking work aligns with previous AI-focused efforts like Google’s OSS-Fuzz initiative, which has successfully exposed hidden vulnerabilities within various open-source projects.
### Competition Miss and Wider Kernel Findings
The exploit that Jia Jie developed was prepared for the TyphoonPwn 2026 competition, which featured a dedicated category for Linux local privilege escalation and offered substantial monetary rewards of $70,000, $35,000, and $17,500 for the first three successful entries. Despite his innovative research, Jia Jie ended up in eighth place out of eleven submissions, and unfortunately, the competition concluded before his entry could be demonstrated, as only three winners were announced.
In an interesting turn of events, an AI tool named KyleBot independently reported the same vulnerability just two days prior to the TyphoonPwn competition. Jia Jie indicated that the flaw had likely existed for a duration of two to three years, positing that AI’s involvement in vulnerability discovery is transforming the landscape, making “zero-day” discoveries appear more akin to “n-day” analyses, due to the rapid identification of pre-existing flaws.
Furthermore, Jia Jie disclosed two additional exploitable vulnerabilities within the performance events subsystem. One specific flaw was assigned the identifier CVE-2026-64300. These issues could be triggered on Intel bare-metal systems that employ a permissive performance-monitoring configuration, thereby impacting primarily RHEL-based and Arch systems, but not Debian-based distributions. This highlights the ongoing relevance of vulnerabilities to desktop Linux environments.
While acknowledging the advancements facilitated by AI in accelerating bug hunting, Jia Jie noted the limitations of such automated systems. He observed that these systems still exhibit blind spots and reasoning failures, reinforcing the notion that a comprehensive understanding of subsystem mechanics is essential for identifying weaknesses that automated tools might overlook.
Following the public disclosure, CVE-2026-53264 has been addressed with a patch made available upstream. The fix prevents the problematic memory from being freed until after the RCU grace period has expired, effectively eliminating the use-after-free vulnerability. As a precautionary measure, Linux users and system administrators are urged to secure updated kernels through their respective distribution’s security update channels, ensuring that their systems remain protected against this newly unveiled threat.
This incident underscores not only the potential for AI technologies to aid in the discovery of security vulnerabilities but also the importance of ongoing vigilance and detailed subsystem knowledge in the cybersecurity landscape.