CVE-2026-53264 — Linux Vulnerability Details

What is CVE-2026-53264?

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() 0, mutex held 1: idr_remove(idr, index) tcfa_refcnt) 0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.

The record classifies CVE-2026-53264 under weakness class CWE-416. Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 139 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 7.8 — HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (FIRST): 0.2% probability of exploitation in the next 30 days, higher than 14.0% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 6.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-06-25

Is CVE-2026-53264 being exploited?

Weaponised exploit code for CVE-2026-53264 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 25 in the Threadlinqs vulnerability feed.

HORKimhab/CVE-2026-53264 (github)
trickest/cve (trickest)

Affected products and versions

Linux: Linux

How to fix CVE-2026-53264

No vendor patch reference has been recorded for CVE-2026-53264 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-53264

2 tracked threats in the Threadlinqs corpus reference CVE-2026-53264, either in the campaign’s CVE list or as an indicator on the campaign record.

Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit — HIGH · 2026-11-11
CVE-2026-53264: AI-Assisted Discovery of Linux Kernel net/sched Use-After-Free Enabling Local Root Privilege Escalation — HIGH · 2026-07-28

Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories.

Other references

Showing 5 of 8 recorded references.