# CVE-2026-53264 — Linux

> As of 2026-11-11, CVE-2026-53264 is a HIGH-severity vulnerability in Linux, CVSS v3.1 7.8, EPSS 0.2% (14.0th percentile). Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2026-53264, most recently “Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit”.

**Last updated:** 2026-11-11

## What is CVE-2026-53264?

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() 0, mutex held 1: idr_remove(idr, index) tcfa_refcnt) 0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur.

The record classifies CVE-2026-53264 under weakness class [CWE-416](https://intel.threadlinqs.com/cwe/CWE-416). Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 139 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 7.8 — HIGH (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **EPSS (FIRST):** 0.2% probability of exploitation in the next 30 days, higher than 14.0% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 6.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-06-25

## Is CVE-2026-53264 being exploited?

Weaponised exploit code for CVE-2026-53264 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 25 in the Threadlinqs vulnerability feed.

- [HORKimhab/CVE-2026-53264](https://github.com/HORKimhab/CVE-2026-53264) (github)
- [trickest/cve](https://github.com/trickest/cve/blob/main/2026/CVE-2026-53264.md) (trickest)

## Affected products and versions

- [Linux](https://intel.threadlinqs.com/vendors/linux): Linux

## How to fix CVE-2026-53264

No vendor patch reference has been recorded for CVE-2026-53264 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-53264

2 tracked threats in the Threadlinqs corpus reference CVE-2026-53264, either in the campaign’s CVE list or as an indicator on the campaign record.

- [Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit](https://intel.threadlinqs.com/threat/TL-2026-5729) — HIGH · 2026-11-11
- [CVE-2026-53264: AI-Assisted Discovery of Linux Kernel net/sched Use-After-Free Enabling Local Root Privilege Escalation](https://intel.threadlinqs.com/threat/TL-2026-1744) — HIGH · 2026-07-28

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories.

**Other references**

- [git.kernel.org](https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3)
- [git.kernel.org (18af5d2ef0c4f65787fd1280c8b23286b9f2a835)](https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835)
- [git.kernel.org (1f1b98fea6b9ea30507d0f2fbff6750292d097e2)](https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2)
- [git.kernel.org (8b136f18ac4b2ace5aaad3305b3f8a5d8165a009)](https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009)
- [git.kernel.org (5dd51e09020c65aa53cf128e5e3517cd53b3c113)](https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113)

_Showing 5 of 8 recorded references._

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-53264
Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Sign up free (Blue): https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds (https://threadlinqs.com/tl-creds); MCP access for AI agents needs Purple: https://intel.threadlinqs.com/mcp