# AI Uncovers Critical Linux Kernel Flaw Enabling Root Access

*Published July 29, 2026*
*Source: [https://www.infosecurity-magazine.com/news/ai-linux-kernel-zero-day-net-sched/](https://www.infosecurity-magazine.com/news/ai-linux-kernel-zero-day-net-sched/)*

## Executive Summary

AI-assisted research has revealed a critical zero-day vulnerability in the Linux kernel's net/sched component, allowing potential local root access. The flaw, identified as CVE-2026-53264, has been patched, and users should update their systems promptly.

## Article

A significant vulnerability in the Linux kernel has been uncovered through AI-assisted research, revealing a use-after-free zero-day flaw in the net/sched component. This flaw, identified as CVE-2026-53264, was discovered by Lee Jia Jie from STAR Labs during an internship, marking his introduction to Linux kernel work. The net/sched component is responsible for managing how network packets are transmitted, and the flaw arises from mismatched locking mechanisms around a shared data structure. This issue leads to a race condition where the kernel might continue using an object even after its memory has been released, potentially granting an unprivileged local user root access under certain conditions. The vulnerability was specifically tested on a CentOS Stream 9 desktop and requires unprivileged user namespaces along with two other kernel options to be exploited successfully. 

Jia Jie leveraged artificial intelligence to identify the bug, generate a crash proof, and enhance the efficiency of triggering the race condition. The optimization efforts reduced the time to exploit the condition from over 15 minutes to approximately five seconds. This discovery follows previous AI-driven efforts like Google's OSS-Fuzz, which have also aimed at exposing hidden flaws in open-source software. The exploit was prepared for the TyphoonPwn 2026 competition, although it was not demonstrated due to the competition's closure after the top three positions were filled. 

Additionally, Jia Jie reported two other exploitable issues in the perf events subsystem, one of which was assigned CVE-2026-64300. These issues primarily affect Intel bare-metal systems with a permissive performance-monitoring setting and are relevant to RHEL-based and Arch systems, rather than Debian-based distributions. Despite the promise AI shows in accelerating the discovery of such vulnerabilities, Jia Jie noted that detailed knowledge of subsystems remains crucial, as AI can sometimes miss certain intricacies. 

The CVE-2026-53264 vulnerability has been patched upstream, eliminating the use-after-free window by deferring the object freeing process until after the RCU grace period. Linux users and administrators are advised to apply the patched kernels available through their distribution's security update channels to mitigate this risk.