Threat video1:00
CVE-2026-53264 Linux net/sched LPE: Detection & IOCs
STAR Labs' public exploit escalates privileges on CentOS Stream 9 via CVE-2026-53264, with 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-53264 Linux net/sched LPE: Detection & IOCs →
Chapters
- 0:00The hookPublic Linux exploit: root in roughly 10-70 seconds.
- 0:05The storyA researcher documented a reliable exploit.
- 0:12Attack pathStarts as an unprivileged local user.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise10 indicators to hunt: 4 hashes, 5 file names and 1 path.
- 0:37MITRE ATT&CK techniques7 ATT&CK techniques, from execution to collection.
- 0:42Remediation4 steps now: Apply the upstream stable kernel patch.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Public Linux exploit: root in roughly 10-70 seconds.
0:05A researcher documented a reliable exploit.
0:08Both bugs are fixed upstream.
0:12Starts as an unprivileged local user.
0:15Then a race condition in packet scheduling.
0:17In a test, the public code reached root.
0:20A second flaw reached root on Arch.
0:26No threat actor is attributed. Confidence: low.
0:3110 indicators to hunt: 4 hashes, 5 file names and 1 path.
0:377 ATT&CK techniques, from execution to collection.
0:424 steps now: Apply the upstream stable kernel patch.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.