# Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit

> STAR Labs researcher Lee Jia Jie (TyphoonPwn 2026) documented a reliable local privilege-escalation exploit for CVE-2026-53264, a race-condition use-after-free in the Linux net/sched traffic-control action API (tcf_idr_check_alloc / act_api.c), demonstrated on CentOS Stream 9. The same write-up covers CVE-2026-64300, a page-level use-after-free in the perf/aux ring-buffer subsystem (map_range() racing rb_alloc_aux()), converted into a reliable LPE on an Arch Linux kernel. Both bugs are fixed upstream; no in-the-wild exploitation is reported and neither CVE is in the CISA KEV catalog as of this research.

- **Published:** 2026-11-11T05:28:17Z
- **Last reviewed:** 2026-11-11T05:28:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5729
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5729.png
- **ID:** TL-2026-5729
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 11 (3 shown free below)
- **CVEs:** CVE-2026-53264, CVE-2026-64300, CVE-2025-21700

## Description

CVE-2026-53264 is a use-after-free in the Linux kernel's net/sched packet-scheduler action lifecycle (net/sched/act_api.c, function tcf_idr_check_alloc()). The per-net action_idr lookup path runs under rcu_read_lock() only, while actual action teardown runs under idrinfo->lock plus rtnl_lock() and performs a raw kfree() with no RCU grace period, so a thread racing RTM_NEWTFILTER against RTM_DELTFILTER can take a reference to an action object that a second thread has already freed. The regression was introduced by upstream commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu"), which removed the RCU-deferred free path; the fix (stable commit 5057e1aca011e51ef51498c940ef96f3d3e8a305) reverts to kfree_rcu()-based deferred freeing. Exploitation does not require RTM_NEWACTION/RTM_DELACTION (which demand CAP_NET_ADMIN in the init namespace); instead it is reached purely through RTM_NEWTFILTER/RTM_DELTFILTER filter operations gated only by CAP_NET_ADMIN inside an unprivileged user namespace, combined with a clsact qdisc and a flower classifier (requiring CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER built in or as modules) whose DOIT_UNLOCKED handlers avoid serializing on rtnl_lock. STAR Labs built a reliable public PoC (github.com/star-sg/CVE, directory CVE-2026-53264: poc.c, pwn_utils.cpp/.h, dmesg_msr_kaslr.c/.h, Makefile) that: (1) widens the UAF race window using timerfd + epoll waiter stacking (per Project Zero's 'Racing Against the Clock' technique) and splits filter-creation threads across separate tc chains to avoid per-chain mutex contention in tcf_chain_tp_find; (2) uses a binder/deleter thread model where 'binder' threads submit a two-action filter (a valid action at index 42 followed by a deliberately invalid action that aborts the batch insert in tcf_action_init, leaving no filter created) while a single 'deleter' thread repeatedly creates and deletes a filter referencing action 42 to keep the target object populated in the IDR — cutting mean time-to-hit from over 15 minutes to roughly 5 seconds; (3) defeats KASLR via the EntryBleed technique; (4) reclaims the freed tc_action object (resident in the kmalloc-256 slab cache) with a user_key_payload object groomed through repeated KEYCTL_UPDATE syscalls, whose rcu.next field overlaps the freed object's ops vtable pointer, achieving RIP control through the indirect call to get_fill_size() inside tcf_action_fill_size() at offset +0x70; (5) pivots the stack onto the reclaimed heap buffer using a `leave; pop rax; mov rax,r9; pop rbp; pop r14; jmp __x86_return_thunk` gadget at .ktext+0x6ccc7d (the rbp register, controlled by the attacker-groomed payload, points into the reclaimed buffer); (6) builds a ROP chain that overwrites /proc/sys/kernel/core_pattern with a crafted pipe-handler string (`|/proc/%P/fd/666 %P`) via copy_from_user, then calls msleep to avoid returning execution while the kernel stack still resides inside a freed/reclaimed heap object; and (7) escalates privileges by having the exploit process create a memfd copy of its own executable, dup it to file descriptor 666, then deliberately crash a process — causing the kernel's core-dump handler to execute the attacker's binary as root in the initial namespace. A BPF-JIT-based 'kernel one-gadget' arbitrary-write alternative was evaluated and discarded as unreliable (inconsistent across machines, intermittent FPU state corruption). The exploit was demonstrated against CentOS Stream 9 (CentOS-Stream-9-20260706.0-x86_64 test image) on Intel laptop hardware (i5-1235U), achieving root in roughly 10-70 seconds across ten consecutive runs (one outlier at 111s attributed to thermal throttling); ROP gadget offsets are kernel-build-specific and must be re-tuned per target image, and the technique additionally breaks on newer kernels that change tcf_action_fill_size's frame-pointer register (ebp vs rbp), which defeats the described stack-pivot gadget. The bug is described by the author as roughly 2-3 years old at disclosure time, and was independently reported to the vendor by a second researcher ('KyleBot') two days before the author's TyphoonPwn 2026 submission. CVE-2026-64300 is a related but independent use-after-free in the perf event subsystem's auxiliary (AUX) ring-buffer code. map_range() in kernel/events/core.c reads AUX-buffer page metadata while holding only the per-event mmap_mutex, not the rb->aux_mutex that is supposed to serialize those fields against concurrent buffer (re)allocation; two perf_events configured to share one ring buffer via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() against map_range(), letting a local process map a physical page that is concurrently freed and reused. Because pages mapped this way carry the VM_PFNMAP flag they bypass normal page refcounting, turning the race into a genuine use-after-free of physical memory rather than a mere stale mapping. The upstream fix (tip commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c, 'perf/aux: Fix page UAF in map_range()', preceded by related fixes c8b7e113f7b61eef2f017e6329c27c2331058c5a and 0cff05bd2186020f8706233e261016d149cc24db) takes rb->aux_mutex across the page walk in map_range(). STAR Labs converted this into a reliable LPE, tested on an Arch Linux kernel build 7.0.12-arch1-1; exploitation requires Intel bare-metal hardware exposing the intel_pt PMU and perf_event_paranoid <= 2, a sysctl default true on RHEL-family and Arch systems but not on Debian-family distributions, making the bug primarily relevant to desktop/workstation Linux rather than hardened cloud servers. The same blog post also describes a related, CVE-less perf/events bug (kernel/events/core.c) described as a 'raw free with RCU access' pattern yielding an uncontrolled UAF-write primitive, fixed upstream by tip commit e62d4192e593630f355094adc467058a05bdc935; this bug was evaluated but not converted into a full exploit chain by the author and carries no assigned CVE. Both numbered CVEs were publicly disclosed via STAR Labs' blog post 'When AI Makes 0-Days Feel Like N-Days' (27 July 2026), which also recounts that the author's CVE-2026-53264 exploit, while technically successful, placed 8th of 11 entrants in the Linux LPE category at the TyphoonPwn 2026 competition (Singapore, 27 May 2026) and was never demonstrated live because three winning entries had already been declared before the author's queued slot.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1082 System Information Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1547.006 Kernel Modules and Extensions
- T1055 Process Injection
- T1119 Automated Collection
- T1497 Virtualization/Sandbox Evasion

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-53264 net/sched UAF Staging — Unprivileged User Namespace plus Traffic-Control Setup (Exploitation)** (`TL-2026-5729-SPL-001`)

Behavioural detection for the exploitation stage of CVE-2026-53264 (Linux net/sched act_api tcf_idr_check_alloc use-after-free, TL-2026-5729). The public star-sg/CVE PoC creates an unprivileged user namespace to gain CAP_NET_ADMIN, then builds a clsact qdisc with a flower classifier and races RTM_NEWTFILTER against RTM_DELTFILTER. Autoloading of cls_flower, act_gact and sch_ingress is a kernel module side effect. The search correlates, per login-uid and 5-minute window, at least two of three auditd rule keys: userns_create (unshare/clone with CLONE_NEWUSER), tc_netsched_exec (tc binary use) and netsched_modprobe (net/sched module autoload). Requires the auditd rules listed in tuning_notes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1547.006
- **Data sources:** auditd, linux:audit
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="linux:audit" type=SYSCALL (key="userns_create" OR key="tc_netsched_exec" OR key="netsched_modprobe") auid!=4294967295 auid!=0
| bin _time span=5m
| stats dc(key) as stages values(key) as stage_keys values(exe) as exes values(comm) as comms count by host auid _time
| where stages>=2
| table _time host auid stage_keys exes comms count
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has 'type=SYSCALL'
| where SyslogMessage has_any ('userns_create', 'tc_netsched_exec', 'netsched_modprobe')
| extend Auid = extract(@'auid=(\d+)', 1, SyslogMessage), Exe = extract(@'exe="([^"]+)"', 1, SyslogMessage), AuditKey = extract(@'key="([^"]+)"', 1, SyslogMessage)
| where isnotempty(Auid) and Auid !in ('4294967295', '0')
| summarize Stages = dcount(AuditKey), StageKeys = make_set(AuditKey), Exes = make_set(Exe), Events = count() by Computer, Auid, bin(TimeGenerated, 5m)
| where Stages >= 2
| project TimeGenerated, Computer, Auid, StageKeys, Exes, Events
```

### Sigma

```yaml
title: Unprivileged User Namespace and Traffic-Control Staging Consistent with CVE-2026-53264
id: 3f6c1a52-8d0e-4b7a-9c41-5e2a7b9d0c11
status: experimental
description: Detects auditd rule keys for unprivileged user namespace creation, tc usage and net/sched module autoload, the setup steps of the public CVE-2026-53264 (net/sched act_api UAF) exploit. Alert on 2 or more distinct keys from the same auid within 5 minutes.
references:
    - https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/
    - https://github.com/star-sg/CVE/tree/master/CVE-2026-53264
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.privilege-escalation
    - attack.t1068
    - attack.persistence
    - attack.t1547.006
    - cve.2026.53264
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        key:
            - 'userns_create'
            - 'tc_netsched_exec'
            - 'netsched_modprobe'
    filter_root:
        auid: '0'
    condition: selection and not filter_root
falsepositives:
    - Rootless container runtimes (podman, buildah, bubblewrap, Flatpak) creating user namespaces
    - Network engineers or CI jobs running tc in lab namespaces
level: medium
```

**Known false positives:**

- Rootless container runtimes (podman, buildah, bubblewrap, Flatpak) legitimately create user namespaces and may load net/sched modules
- Network engineers or CI jobs configuring tc qdiscs and flower filters in lab network namespaces

**Tuning notes:** Add auditd rules: -a always,exit -F arch=b64 -S unshare,clone,clone3 -F auid>=1000 -F auid!=-1 -k userns_create ; -w /usr/sbin/tc -p x -k tc_netsched_exec ; -w /sbin/modprobe -p x -k netsched_modprobe (or audit finit_module/init_module for cls_flower, act_gact, sch_ingress). Allow-list hosts running rootless containers, raise stages to 3 on developer workstations, and prioritise hosts running kernels that contain commit d7fb60b9cafb without 5057e1aca011.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-64300 perf_event_open Abuse by Non-Root Processes (perf/aux page-UAF Exploitation) (locked: unlock with TL Creds)
- CVE-2026-53264 core_pattern Sysctl File Write Audit Hit (locked: unlock with TL Creds)
- CVE-2026-53264 Public PoC Artifacts — star-sg/CVE Source Files, Clone and Build (locked: unlock with TL Creds)
- CVE-2026-53264 KEYCTL_UPDATE Heap-Spray Loop by Non-Root Process (locked: unlock with TL Creds)
- CVE-2026-53264 memfd Payload Staged via dup to File Descriptor 666 (locked: unlock with TL Creds)
- CVE-2026-53264 KASLR Reconnaissance — dmesg Executed from Writable Staging Directory (locked: unlock with TL Creds)
- CVE-2026-53264 Post-Exploitation — Hijacked kernel.core_pattern Pipe Handler (locked: unlock with TL Creds)
- CVE-2026-53264 Root Payload Execution from memfd or /proc fd Path (Core-Dump Handler Abuse) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 11)

Defanged, TLP:CLEAR.

- File hash: `5057e1aca011e51ef51498c940ef96f3d3e8a305`
- File hash: `5948aaf64f81f217a25dcc2bf6c0779bca19566c`
- File hash: `e62d4192e593630f355094adc467058a05bdc935`

Full set of 11 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [When AI Makes 0-Days Feel Like N-Days (STAR Labs)](https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/)
- [Public exploit for CVE-2026-53264 (star-sg/CVE)](https://github.com/star-sg/CVE/tree/master/CVE-2026-53264)
- [Linux stable fix commit 5057e1aca011e51ef51498c940ef96f3d3e8a305 (net/sched)](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5057e1aca011e51ef51498c940ef96f3d3e8a305)
- [Linux tip.git fix commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c (perf/aux map_range UAF)](https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=5948aaf64f81f217a25dcc2bf6c0779bca19566c)
- [Linux tip.git related fix commit e62d4192e593630f355094adc467058a05bdc935 (perf/events raw free with RCU)](https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=e62d4192e593630f355094adc467058a05bdc935)
- [Red Hat CVE-2026-53264 advisory page](https://access.redhat.com/security/cve/CVE-2026-53264)
- [OSV.dev CVE-2026-64300 record](https://api.osv.dev/v1/vulns/CVE-2026-64300)
- [Tenable CVE-2026-53264 plugin/vulnerability page](https://www.tenable.com/cve/CVE-2026-53264)
- [git.kernel.org stable tree (Linux kernel source)](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git)
- [Project Zero: Racing Against the Clock - Hitting a Tiny Kernel Race Window (timerfd/epoll race-widening technique)](https://projectzero.google/2022/03/racing-against-clock-hitting-tiny.html)
- [google/kernel-research libxdk EntryBleed KASLR-bypass utility](https://github.com/google/kernel-research/blob/main/libxdk/util/pwn_utils.cpp)
- [google/security-research - CVE-2025-21700 kernelctf novel-techniques writeup (BPF JIT one-gadget arbitrary-write reference)](https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2025-21700_lts_cos_mitigation/docs/novel-techniques.md)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5729