Update: 2026-08-18
Update: 2026-08-17
Update: 2026-07-31
Date: 2026-07-30
An important flaw in the Linux kernel’s network scheduler may allow a local attacker to achieve privilege escalation. It is extensively described at [R 1] [R 2], including public exploit code.
NOTE: exploits need unprivileged network namespaces to be enabled.
EGI SVG ID : EGI-SVG-2026-35
CVE ID : CVE-2026-53264
CVSSv3 Score:
Sites are advised to apply mitigation or update as soon as possible the Linux kernel on hosts giving access to unprivileged users, e.g. grid worker nodes, but also container hosts, notebook servers and CI runners.
At the time of writing, fixed kernels are available for only a few of the relevant distributions. Please check the references listed at the bottom of this advisory for your distribution(s), update and reboot affected systems as soon as feasible. Mitigation is described below.
To prevent the published method from exploiting the vulnerability, it is sufficient to disable unprivileged network namespaces [R 8].
Alternatively, on hosts that do not need to use the kernel modules featuring in the example exploit, they can be disabled.
Check if either of them happens to be in use:
lsmod | egrep 'act_gact|cls_flower' && echo WARNING: this mitigation may not work!
To disable the modules:
modprobe -r act_gact cls_flower || echo A reboot is needed for this mitigation to work
cat >/etc/modprobe.d/mitigation-cve-2026-53264.conf << 'EOF'
blacklist act_gact
blacklist cls_flower
install act_gact /bin/false
install cls_flower /bin/false
EOF
TLP:CLEAR information - Unlimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2026-35
https://advisories.egi.eu/Advisory-SVG-CVE-2026-53264
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. -------
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
See [R 99] for further details, and other information on SVG.
SVG was alerted to this vulnerability by Laurent Caillat-Vallet (EGI CSIRT)