How a Rookie Researcher and AI Found a Kernel Hole
A security researcher armed with artificial intelligence has uncovered a years-old Linux kernel 0-Day in the net/sched subsystem. The flaw, disclosed on July 27, lets a local attacker escalate privileges all the way to root.
Lee Jia Jie, from Singapore-based offensive security firm STAR Labs, found the bug during his internship. It was his first real dive into Linux kernel work. The vulnerability is now tracked as CVE-2026-53264.
The issue? A race condition in net/sched — the code that decides when and how network packets get transmitted. One function reads entries under a Read-Copy-Update (RCU) lock. Another path frees an entry without waiting for the RCU grace period. That gap creates a window where the kernel keeps using an object after its memory has been released. A classic use-after-free.
To pull off the exploit, an attacker needs unprivileged user namespaces and two specific kernel options turned on. Jia Jie tested his proof of concept on a CentOS Stream 9 desktop.
AI Did the Heavy Lifting — But Not All of It
Jia Jie didn’t just stumble on the bug. He used AI to identify the problem, produce a crash proof, and improve the reliability of triggering the race. The results are striking: optimization cut the time needed to hit the condition from more than 15 minutes down to about five seconds.
This follows other AI-assisted security work, like Google’s OSS-Fuzz project, which has used AI to expose hidden flaws in open-source software. But Jia Jie’s findings also highlight the limits of automation.
He noted that AI still shows blind spots and reasoning failures. Detailed subsystem knowledge, he concluded, remains critical for finding weaknesses that automated systems miss. The AI found the bug fast — but it didn’t understand why it mattered.
TyphoonPwn 2026: A Competition Miss and a Surprise
Jia Jie prepared his exploit for TyphoonPwn 2026’s Linux local privilege escalation category. The prize pool was generous: $70,000 for first, $35,000 for second, $17,500 for third. He drew position eight out of 11 competitors. But the category closed after three winners were announced, so his entry was never demonstrated.
Here’s the twist: KyleBot, an AI system, had independently reported the same bug two days before the competition started. Jia Jie said the defect had existed for two to three years. He described this as evidence that AI can make zero-day work feel more like n-day analysis — the bug was old enough that automated tools could catch it.
More Than One Hole: Perf Events Flaws Found
Jia Jie also reported two exploitable flaws in the perf events subsystem. One got the identifier CVE-2026-64300. These issues were reachable on Intel bare-metal systems under a permissive performance-monitoring setting. They affected RHEL-based and Arch systems, but not Debian-based distributions. Jia Jie noted they were mainly relevant to desktop Linux.
Both flaws could be exploited for privilege escalation, though the attack surface is narrower than the net/sched bug.
Patch Released: What Linux Users Should Do
The good news: CVE-2026-53264 has been patched upstream. The fix defers freeing the affected object until after the RCU grace period, closing the use-after-free window entirely.
Linux users and administrators should obtain fixed kernels through their distribution’s security update channels. If you’re running CentOS Stream, RHEL, or a distro that pulls from the mainline kernel, update now. The patch is also likely backported to stable kernels.
This incident shows that AI-assisted bug hunting is real and growing. But it also proves that human intuition — knowing where to look and why — still matters. The best results come from pairing both.
