Kernel Version Alone Misses This Local-Root Exposure
A patched kernel still leaves room for local root if the runtime knobs line up. This exploit is gated by unprivileged user namespaces and specific traffic-control options, so package version checks can miss hosts that are still reachable from a local foothold.
STAR Labs published working code for CVE-2026-53264, a use-after-free race in Linux traffic control that turns an ordinary user into root on the CentOS Stream 9 build it targeted. The fix landed upstream on June 1, 2026, and the working exploit is now public for a flaw that starts with Linux 4.14 and has fixed releases in several stable branches, including backports.
For Linux fleets that allow unprivileged namespaces, the exposure question is no longer just "is the kernel patched?" Runtime settings decide whether the bug is usable, especially on container-capable hosts where local privilege escalation can become a real path to full takeover.