Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5729 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-53264 net/sched UAF Staging — Unprivileged User Namespace plus Traffic-Control Setup (Exploitation)

Behavioural detection for the exploitation stage of CVE-2026-53264 (Linux net/sched act_api tcf_idr_check_alloc use-after-free, TL-2026-5729). The public star-sg/CVE PoC creates an unprivileged user namespace to gain CAP_NET_ADMIN, then builds a clsact qdisc with a flower classifier and races RTM_NEWTFILTER against RTM_DELTFILTER. Autoloading of cls_flower, act_gact and sch_ingress is a kernel module side effect. The search correlates, per login-uid and 5-minute window, at least two of three auditd rule keys: userns_create (unshare/clone with CLONE_NEWUSER), tc_netsched_exec (tc binary use) and netsched_modprobe (net/sched module autoload). Requires the auditd rules listed in tuning_notes.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1068, T1547.006
• Data sources: auditd, linux:audit
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="linux:audit" type=SYSCALL (key="userns_create" OR key="tc_netsched_exec" OR key="netsched_modprobe") auid!=4294967295 auid!=0
| bin _time span=5m
| stats dc(key) as stages values(key) as stage_keys values(exe) as exes values(comm) as comms count by host auid _time
| where stages>=2
| table _time host auid stage_keys exes comms count

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has 'type=SYSCALL'
| where SyslogMessage has_any ('userns_create', 'tc_netsched_exec', 'netsched_modprobe')
| extend Auid = extract(@'auid=(\d+)', 1, SyslogMessage), Exe = extract(@'exe="([^"]+)"', 1, SyslogMessage), AuditKey = extract(@'key="([^"]+)"', 1, SyslogMessage)
| where isnotempty(Auid) and Auid !in ('4294967295', '0')
| summarize Stages = dcount(AuditKey), StageKeys = make_set(AuditKey), Exes = make_set(Exe), Events = count() by Computer, Auid, bin(TimeGenerated, 5m)
| where Stages >= 2
| project TimeGenerated, Computer, Auid, StageKeys, Exes, Events

Sigma

title: Unprivileged User Namespace and Traffic-Control Staging Consistent with CVE-2026-53264
id: 3f6c1a52-8d0e-4b7a-9c41-5e2a7b9d0c11
status: experimental
description: Detects auditd rule keys for unprivileged user namespace creation, tc usage and net/sched module autoload, the setup steps of the public CVE-2026-53264 (net/sched act_api UAF) exploit. Alert on 2 or more distinct keys from the same auid within 5 minutes.
references:
    - https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/
    - https://github.com/star-sg/CVE/tree/master/CVE-2026-53264
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.persistence
    - attack.t1547.006
    - cve.2026.53264
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        key:
            - 'userns_create'
            - 'tc_netsched_exec'
            - 'netsched_modprobe'
    filter_root:
        auid: '0'
    condition: selection and not filter_root
falsepositives:
    - Rootless container runtimes (podman, buildah, bubblewrap, Flatpak) creating user namespaces
    - Network engineers or CI jobs running tc in lab namespaces
level: medium

Known false positives:

• Rootless container runtimes (podman, buildah, bubblewrap, Flatpak) legitimately create user namespaces and may load net/sched modules
• Network engineers or CI jobs configuring tc qdiscs and flower filters in lab network namespaces

Tuning notes: Add auditd rules: -a always,exit -F arch=b64 -S unshare,clone,clone3 -F auid>=1000 -F auid!=-1 -k userns_create ; -w /usr/sbin/tc -p x -k tc_netsched_exec ; -w /sbin/modprobe -p x -k netsched_modprobe (or audit finit_module/init_module for cls_flower, act_gact, sch_ingress). Allow-list hosts running rootless containers, raise stages to 3 on developer workstations, and prioritise hosts running kernels that contain commit d7fb60b9cafb without 5057e1aca011.

• 🔒 CVE-2026-64300 perf_event_open Abuse by Non-Root Processes (perf/aux page-UAF Exploitation) · unlock with TL Creds
• 🔒 CVE-2026-53264 core_pattern Sysctl File Write Audit Hit · unlock with TL Creds
• 🔒 CVE-2026-53264 Public PoC Artifacts — star-sg/CVE Source Files, Clone and Build · unlock with TL Creds
• 🔒 CVE-2026-53264 KEYCTL_UPDATE Heap-Spray Loop by Non-Root Process · unlock with TL Creds
• 🔒 CVE-2026-53264 memfd Payload Staged via dup to File Descriptor 666 · unlock with TL Creds
• 🔒 CVE-2026-53264 KASLR Reconnaissance — dmesg Executed from Writable Staging Directory · unlock with TL Creds
• 🔒 CVE-2026-53264 Post-Exploitation — Hijacked kernel.core_pattern Pipe Handler · unlock with TL Creds
• 🔒 CVE-2026-53264 Root Payload Execution from memfd or /proc fd Path (Core-Dump Handler Abuse) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5729.

Sample indicators (3 of 11)

• File hash: 5057e1aca011e51ef51498c940ef96f3d3e8a305
• File hash: 5948aaf64f81f217a25dcc2bf6c0779bca19566c
• File hash: e62d4192e593630f355094adc467058a05bdc935

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

Both bugs are fixed upstream; no in-the-wild exploitation is reported and neither CVE is in the CISA KEV catalog as of this research.

CVE-2026-53264 is a use-after-free in the Linux kernel's net/sched packet-scheduler action lifecycle (net/sched/act_api.c, function tcf_idr_check_alloc()). The per-net action_idr lookup path runs under rcu_read_lock() only, while actual action teardown runs under idrinfo->lock plus rtnl_lock() and performs a raw kfree() with no RCU grace period, so a thread racing RTM_NEWTFILTER against RTM_DELTFILTER can take a reference to an action object that a second thread has already freed. The regression was introduced by upstream commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu"), which removed the RCU-deferred free path; the fix (stable commit 5057e1aca011e51ef51498c940ef96f3d3e8a305) reverts to kfree_rcu()-based deferred freeing. Exploitation does not require RTM_NEWACTION/RTM_DELACTION (which demand CAP_NET_ADMIN in the init namespace); instead it is reached purely through RTM_NEWTFILTER/RTM_DELTFILTER filter operations gated only by CAP_NET_ADMIN inside an unprivileged user namespace, combined with a clsact qdisc and a flower classifier (requiring CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER built in or as modules) whose DOIT_UNLOCKED handlers avoid serializing on rtnl_lock. STAR Labs built a reliable public PoC (github.com/star-sg/CVE, directory CVE-2026-53264: poc.c, pwn_utils.cpp/.h, dmesg_msr_kaslr.c/.h, Makefile) that: (1) widens the UAF race window using timerfd + epoll waiter stacking (per Project Zero's 'Racing Against the Clock' technique) and splits filter-creation threads across separate tc chains to avoid per-chain mutex contention in tcf_chain_tp_find; (2) uses a binder/deleter thread model where 'binder' threads submit a two-action filter (a valid action at index 42 followed by a deliberately invalid action that aborts the batch insert in tcf_action_init, leaving no filter created) while a single 'deleter' thread repeatedly creates and deletes a filter referencing action 42 to keep the target object populated in the IDR — cutting mean time-to-hit from over 15 minutes to roughly 5 seconds; (3) defeats KASLR via the EntryBleed technique; (4) reclaims the freed tc_action object (resident in the kmalloc-256 slab cache) with a user_key_payload object groomed through repeated KEYCTL_UPDATE syscalls, whose rcu.next field overlaps the freed object's ops vtable pointer, achieving RIP control through the indirect call to get_fill_size() inside tcf_action_fill_size() at offset +0x70; (5) pivots the stack onto the reclaimed heap buffer using a `leave; pop rax; mov rax,r9; pop rbp; pop r14; jmp __x86_return_thunk` gadget at .ktext+0x6ccc7d (the rbp register, controlled by the attacker-groomed payload, points into the reclaimed buffer); (6) builds a ROP chain that overwrites /proc/sys/kernel/core_pattern with a crafted pipe-handler string (`|/proc/%P/fd/666 %P`) via copy_from_user, then calls msleep to avoid returning execution while the kernel stack still resides inside a freed/reclaimed heap object; and (7) escalates privileges by having the exploit process create a memfd copy of its own executable, dup it to file descriptor 666, then deliberately crash a process — causing the kernel's core-dump handler to execute the attacker's binary as root in the initial namespace. A BPF-JIT-based 'kernel one-gadget' arbitrary-write alternative was evaluated and discarded as unreliable (inconsistent across machines, intermittent FPU state corruption). The exploit was demonstrated against CentOS Stream 9 (CentOS-Stream-9-20260706.0-x86_64 test image) on Intel laptop hardware (i5-1235U), achieving root in roughly 10-70 seconds across ten consecutive runs (one outlier at 111s attributed to thermal throttling); ROP gadget offsets are kernel-build-specific and must be re-tuned per target image, and the technique additionally breaks on newer kernels that change tcf_action_fill_size's frame-pointer register (ebp vs rbp), which defeats the described stack-pivot gadget. The bug is described by the author as roughly 2-3 years old at disclosure time, and was independently reported to the vendor by a second researcher ('KyleBot') two days before the author's TyphoonPwn 2026 submission. CVE-2026-64300 is a related but independent use-after-free in the perf event subsystem's auxiliary (AUX) ring-buffer code. map_range() in kernel/events/core.c reads AUX-buffer page metadata while holding only the per-event mmap_mutex, not the rb->aux_mutex that is supposed to serialize those fields against concurrent buffer (re)allocation; two perf_events configured to share one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() against map_range(), letting a local process map a physical page that is concurrently freed and reused. Because pages mapped this way carry the VM_PFNMAP flag they bypass normal page refcounting, turning the race into a genuine use-after-free of physical memory rather than a mere stale mapping. The upstream fix (tip commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c, 'perf/aux: Fix page UAF in map_range()', preceded by related fixes c8b7e113f7b61eef2f017e6329c27c2331058c5a and 0cff05bd2186020f8706233e261016d149cc24db) takes rb->aux_mutex across the page walk in map_range(). STAR Labs converted this into a reliable LPE, tested on an Arch Linux kernel build 7.0.12-arch1-1; exploitation requires Intel bare-metal hardware exposing the intel_pt PMU and perf_event_paranoid <= 2, a sysctl default true on RHEL-family and Arch systems but not on Debian-family distributions, making the bug primarily relevant to desktop/workstation Linux rather than hardened cloud servers. The same blog post also describes a related, CVE-less perf/events bug (kernel/events/core.c) described as a 'raw free with RCU access' pattern yielding an uncontrolled UAF-write primitive, fixed upstream by tip commit e62d4192e593630f355094adc467058a05bdc935; this bug was evaluated but not converted into a full exploit chain by the author and carries no assigned CVE. Both numbered CVEs were publicly disclosed via STAR Labs' blog post 'When AI Makes 0-Days Feel Like N-Days' (27 July 2026), which also recounts that the author's CVE-2026-53264 exploit, while technically successful, placed 8th of 11 entrants in the Linux LPE category at the TyphoonPwn 2026 competition (Singapore, 27 May 2026) and was never demonstrated live because three winning entries had already been declared before the author's queued slot.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1055 Process Injection

Discovery

T1082 System Information Discovery

Collection

T1119 Automated Collection

Defense Evasion

T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Execution

T1203 Exploitation for Client Execution

Persistence

T1547.006 Kernel Modules and Extensions

Remediation

Patches

• Linux stable commit 5057e1aca011e51ef51498c940ef96f3d3e8a305 (net/sched action-lifecycle RCU fix, CVE-2026-53264)
• Linux tip.git commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c (perf/aux: Fix page UAF in map_range(), CVE-2026-64300)
• Linux tip.git commits c8b7e113f7b61eef2f017e6329c27c2331058c5a and 0cff05bd2186020f8706233e261016d149cc24db (prerequisite perf/aux fixes for CVE-2026-64300)
• Linux tip.git commit e62d4192e593630f355094adc467058a05bdc935 (related perf/events raw-free-with-RCU fix, no CVE assigned)

Immediate actions

• Apply the upstream stable kernel patch (commit 5057e1aca011e51ef51498c940ef96f3d3e8a305) for CVE-2026-53264 and the tip.git patch (commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c, plus prerequisite commits c8b7e113f7b61eef2f017e6329c27c2331058c5a and 0cff05bd2186020f8706233e261016d149cc24db) for CVE-2026-64300, and reboot affected hosts
• As an interim mitigation for CVE-2026-53264, disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 or kernel.apparmor_restrict_unprivileged_userns=1) on hosts that do not require them
• As an interim mitigation for CVE-2026-64300, set /proc/sys/kernel/perf_event_paranoid to 3 (or restrict perf_event_open via seccomp/LSM) on Intel bare-metal desktop and workstation systems
• Blacklist or restrict loading of CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER on systems that do not require traffic-control actions/classifiers

Workarounds

• Disable unprivileged user namespace creation
• Set perf_event_paranoid >= 3 on Intel bare-metal desktop/workstation kernels
• Disable CONFIG_NET_ACT_GACT / CONFIG_NET_CLS_FLOWER where traffic-control actions are not needed

Longer-term hardening

• Track and apply distro kernel errata (Red Hat, SUSE, openSUSE, Oracle Linux) as they publish backports for both CVEs
• Deploy kernel runtime integrity / exploit mitigation tooling (e.g., lockdown mode, KASLR hardening, grsecurity-style RAP/CFI) on multi-tenant and desktop Linux fleets
• Monitor core_pattern sysctl writes and unexpected memfd-based process execution as a detection signal for this exploitation technique class
• Restrict perf_event_open() and unprivileged user namespace creation fleet-wide via seccomp profiles or LSM policy where business need allows

Affected and fixed versions

• Linux kernel community — Linux kernel - net/sched (act_api.c, tcf_idr_check_alloc)
  Vulnerable versions: kernels from commit d7fb60b9cafb (net_sched: get rid of tcfa_rcu) up to and excluding the fix
  Fixed in: kernels containing stable commit 5057e1aca011e51ef51498c940ef96f3d3e8a305
• Linux kernel community — Linux kernel - perf events AUX ring buffer (kernel/events/core.c, map_range)
  Vulnerable versions: 6.14.0 up to 6.18.39; 6.19.0 up to 7.1.4
  Fixed in: 6.18.39; 7.1.4; kernels containing tip commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c
• Red Hat — Red Hat Enterprise Linux (CVE-2026-53264)
  Vulnerable versions: RHEL 7; RHEL 10
  Fixed in: pending vendor errata at time of this research
• CentOS — CentOS Stream 9
  Vulnerable versions: CentOS-Stream-9-20260526.0-x86_64; CentOS-Stream-9-20260706.0-x86_64
  Fixed in: pending upstream kernel patch adoption
• Arch Linux — Arch Linux kernel (linux package)
  Vulnerable versions: 7.0.12-arch1-1 and earlier unpatched builds
  Fixed in: builds including tip commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c
• SUSE — SUSE Linux Enterprise / openSUSE kernel (CVE-2026-64300)
  Vulnerable versions: unpatched kernels prior to SUSE-SU-2026:23881-1 / 23887-1 / 23897-1 / 23902-1 and openSUSE-SU-2026:11476-1 / 21910-1
  Fixed in: kernels incorporating the listed SUSE/openSUSE advisories

Timeline

• 2026-05-25 Bug independently reported to the vendor by researcher 'KyleBot' approximately two days before the TyphoonPwn 2026 competition, per the STAR Labs author's account.
• 2026-05-27 TyphoonPwn 2026 (Singapore) held; author submitted a CVE-2026-53264 exploit attempt in the Linux LPE category but placed 8th of 11 entrants after three winners had already been declared before the author's queued slot.
• 2026-06-25 CVE-2026-53264 (net/sched act_api use-after-free) published/assigned, per NVD/Tenable records.
• 2026-07-25 CVE-2026-64300 (perf/aux map_range() page-UAF) first published to NVD/OSV.
• 2026-07-27 Public exploit code for CVE-2026-53264 published at github.com/star-sg/CVE (locked-ioc-9, locked-ioc-7/.h, locked-ioc-5/.h, Makefile).
• 2026-07-27 STAR Labs publishes 'When AI Makes 0-Days Feel Like N-Days,' detailing both CVEs, the full CVE-2026-53264 exploit chain, and releasing the public PoC repository.
• 2026-07-29 NVD record for CVE-2026-53264 updated following public disclosure.
• 2026-08-13 Oracle Linux kernel erratum ELSA-2026-54343 issued addressing CVE-2026-64300.
• 2026-10-15 CVE-2026-53264 NVD/Tenable record last updated, reflecting ongoing vendor advisory consolidation (Red Hat, SUSE, openSUSE).
• 2026-10-28 CVE-2026-64300 NVD record last modified, incorporating additional SUSE/openSUSE advisory references.

Sources cited

• OSV.dev CVE-2026-64300 record api.osv.dev · Advisory · 2026-07-25
• When AI Makes 0-Days Feel Like N-Days (STAR Labs) starlabs.sg · Research · 2026-07-27
• Red Hat CVE-2026-53264 advisory page access.redhat.com · Vendor report
• Tenable CVE-2026-53264 plugin/vulnerability page Tenable · Vendor report · 2026-06-25
• Project Zero: Racing Against the Clock - Hitting a Tiny Kernel Race Window (timerfd/epoll race-widening technique) projectzero.google · Research
• Public exploit for CVE-2026-53264 (star-sg/CVE) GitHub · Proof of concept
• Linux stable fix commit 5057e1aca011e51ef51498c940ef96f3d3e8a305 (net/sched) git.kernel.org · Code repository
• Linux tip.git fix commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c (perf/aux map_range UAF) git.kernel.org · Code repository
• Linux tip.git related fix commit e62d4192e593630f355094adc467058a05bdc935 (perf/events raw free with RCU) git.kernel.org · Code repository
• git.kernel.org stable tree (Linux kernel source) git.kernel.org · Code repository
• google/kernel-research libxdk EntryBleed KASLR-bypass utility GitHub · Code repository
• google/security-research - CVE-2025-21700 kernelctf novel-techniques writeup (BPF JIT one-gadget arbitrary-write reference) GitHub · Code repository

More in vulnerability

• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)

Related coverage of this activity

• Linux net/sched AI root exploit

Previous and next in vulnerability

• Shadow AI-Generated Apps: Unreviewed AI app-builder deployments exposing cloud data (incl. CVE-2025-48757 Supabase missing-policy example) Previous report
• Cisco BroadWorks XXE (CVE-2026-20320) and Openwave Messaging Webtop Media Transcoder (CVE-2026-111793) Actively Exploited; Added to CISA KEV Next report