Artificial Intelligence Finds Zero Day Alet on Linux Kernel

Linux kernel’s network traffic control is an open for two three years in the subsystem, appeared with research published on July 27, 2026. CVE-2026-53264 coded error removes an ordinary local user from root. Alet says that the researchers used artificial intelligence in the process. What the error in the article is, what artificial intelligence is fully accelerated, and why this contribution can not be measured.

What is CVE-2026-53264 Alet?

Open, Linux Kernel net/sched The package is located in the lower system of timing. This subsystem manages when and how to transmit network packages. Error type use-after-free, i.e. continue to be used for a free-released object.

The name that publishes the Bulguyu is the Singapore-based offset security firm STAR Labs from Lee Jia Jie. According to the own technical article of the researcher error was found during the internship period during the first study on the core. The developed abuse code was presented with the CentOS Stream 9 desktop target to the TyphoonPwn 2026 competition.

The impact is rooted, but the scope is limited. This remote code is not running, local authorization upgrade. The machine of the saldurga needs to have a already hold point.

How Does Open Core Do?

Root cause a lock numbness. Looking for indexing shared traffic control actions tcf_idr_check_alloc() function only reads under RCU reading lock. In response to the same objects under different locks, the RCU waiting time can be released without unexpected.

It opens an incompatible race window. A free abandoned object can be used without checking the number of references, and here is a way to control memory distortion.

Upflow spread came on 1 June 2026 and moved back to stable branches. The correction is closing the window by melting the release of the object after RCU waiting time.

What exactly did Artificial Intelligence in Process?

The testimony of the researcher is clear at this point. Artificial intelligence was used in three stages: the discovery of the error, the core memory controller is produced by a concept proof with KASAN and improving the race window.

Jia Jie also states that this exploit follows a different approach from previous work. Instead of understanding every detail from the foundation, it says that artificial intelligence also uses it to ensure this speed.

Övgü is not single-sided. According to the transfer of Infosecurity Magazine The researcher noted that artificial intelligence accelerates the error hunting but shows blind spots and reasoning errors; the detailed subsystem information was still necessary to find the weaknesses that automated systems are missing.

Why Do The Same Error Two Teams Find The Same Week?

The most remarkable part of the story is here. Jia Jie found error independently, but after two days before the competition, the same error was already reported by KyleBot. Upstream patch shows Kyle Zeng, which uses KyleBot nickname as reported.

The researcher says it was not surprised to this situation and also gives the reason: although the error was two three years, there was no additional context by artificial intelligence.

This is the main signal. For many years, an error no one sees, artificial intelligence was found by two separate parties in a week when it is directed to that code area. The title given to the article of the researcher tells you exactly that: AI feels like zero days n-day. So the discovery, which is previously rare and expensive, starts to resemble routine analysis.

Another face of the same ability was on the agenda a few days ago. OpenAI models from the evaluation environment and leak into the production infrastructure He showed what is possible on the attack side. This finding is the equivalent in the defense research of the same ability.

Why Does Additive Know?

There is an open that can be verified in the middle, there is no claim for an accurate AI.

Based on The Hacker News The model is not possible to use the statement as a measure of artificial intelligence capacity, as prompts are not shared the service or interaction record used; it is also not possible to distinguish the contribution of the system from the guidance and reasoning of the researcher. Broadcast asked details on the AI system and test environment used to STAR Labs.

Deficiency reduces the value of research but determines how the claim should be read. There is a moderate experience transfer, not a measured capacity comparison.

How Much Does The Risk Work In Which Terms Are You?

There are several conditions for the work of the abuse shown: the unauthorized user is open, the two core configuration options are enabled and a code chain with special fixed addresses to the target draw. These conditions are reduced by instant exposure.

All of the abuse source code on the other hand STAR Labs's GitHub store published.

The table on the distribution side is not equal. As of July 28, Debian lists fixed cores for supported stable versions, Ubuntu still points out the core package in multiple maintenance, SUSE shows that the topic is waiting on multiple products. SUSE reveals 5.5 points and only uses a vector that saves the effect of accessibility; this is NVD registration Stay under 7.8 reviews.

These followers show the package status, are not working on the field of several systems with the necessary names and core options. The reviewed resources do not reveal the size of the mass under the risk of emergency. No registration in CISA catalog and no abuse was reported on the site as of July 28.

What Does Understanding Come For Bulgu Security Ecosystem?

My practical interest is simple. Unauthorised user ad domains suggest review core versions of open Linux desktop and server running institutions. Instead of relying on upstream version number, it is necessary to install the distribution core that bears correction.

Two markings on the monitoring side stand out: unusual netlink activity and core_pattern unexpected changes.

My wider interest is related to the economy of discovery. In mature open source code bases, it is necessary to assume that race conditions and memory security errors will be found faster. In the same research kernel/events/core.c In two more abused errors found, one received the CVE-2026-64300 number.

Speeding also breaks on the defending side, but not symmetrical. Depending on the coordination, testing and distribution processes that produce the patch; the vulnerability is not the infected party. Ethical filters removed models The difference in the meantime in case of doing the same job with bad intentions is further opened.

Frequently Asked Questions

Can CVE-2026-53264 be exploited remotely? Unable to speak. This local authority upgrade deficit does not run remote code. Saldurga needs to have a pre-access in the target machine.

Is my system affected? Unauthorised user does not work abuse shown if domains are closed. If open, you need to check the security records of your distribution that your core version does not carry the correction. Upstream version number is not enough indicator alone.

Have you ever been found by artificial intelligence? The researcher says that artificial intelligence is used in improving discovery, concept proof production and racing window. The model used can not be independently verified the size of the contribution, as it does not share prompts and interaction logs.

What does it mean that the same error has found two sides? An error that stands for two three years was found by two separate parties in one week. This is a sign that artificial intelligence makes discovery repeatable in certain code areas.

Is it abused in the field? There is no verified abuse notice as of July 28, 2026, and it is not listed in the catalog of abused vulnerabilities known by CISA. This corresponds to the source code in public case.

It shows that the patch has arrived at the beginning of June, the technical party is closed. Open question elsewhere: unless the share of artificial intelligence in the discovery is documented, such announcements remain as a transfer of experience. What needs the sector is a measurable reference point. The next response to the publication of STAR Labs will show how close it to that point.