AI uncovers zero-day in Linux

Article by Nacata Security, 28/07/2026

Did you know that an AI can find a hidden flaw in your operating system?

A researcher proved it by using AI to hunt a real zero-day in Linux.

The Linux kernel contains millions of lines of code. Finding a flaw buried inside it normally requires years of experience and deep knowledge of the system.

But Lee Jia Jie, an intern with no prior kernel experience, managed it on his very first attempt — with the help of artificial intelligence.

The flaw had been hiding in the kernel for two or three years.

The problem lived in net/sched, the part of the kernel that decides when and how network packets are sent. Inside it, there was an inconsistency in the locking mechanism that protects a shared data structure: one function read that structure under an RCU lock, while another code path could free that memory without waiting for the lock’s grace period to complete.

That time window was the perfect trap.

When memory is freed before the kernel has finished using it, a use-after-free is created: the system keeps reading from an address that no longer belongs to it. A local unprivileged attacker can exploit that window to execute code with root privileges. The attack requires unprivileged user namespaces and two specific kernel options to be enabled.

Given the right conditions, an unprivileged user becomes root.

Jia Jie used AI to identify the bug, generate a crash that demonstrated it, and improve the reliability of the exploit. He also optimized the code, reducing the time needed to trigger the race condition from over fifteen minutes to just five seconds — a leap that completely changes the practical viability of the attack.

AI accelerated everything, without doing it alone.

Jia Jie acknowledged that the AI made reasoning errors and had blind spots. Even so, the result was real: a functional zero-day found in his first week with the kernel, which opens a serious conversation about how vulnerability research is changing.

This was not an isolated case.

KyleBot, another AI system, had independently identified the same bug two days before TyphoonPwn 2026. The fact that two separate systems converged on the same zero-day at nearly the same time says a great deal: flaws that once required decades of experience are now within reach of automated tools. Google had already demonstrated something similar with OSS-Fuzz applied to open-source projects.

AI is bringing zero-day analysis closer to n-day analysis.

When AI can find an unknown zero-day as easily as an analyst studies a documented n-day, the barrier to entry drops dramatically. What was once the exclusive territory of APT groups is starting to become accessible to actors with far fewer resources.

The patch exists, but the risk does not vanish overnight.

CVE-2026-53264 already has an upstream fix: the patch delays the freeing of the object until after the RCU grace period, eliminating the use-after-free window. However, patched kernels reach users through each individual distribution, and not all systems are updated in time.

Updating the kernel is the only real defense.

If you are running an RHEL-based distribution or any Linux desktop, verify that you have the latest patches applied. Jia Jie also reported two additional flaws in the perf events subsystem — one assigned CVE-2026-64300 — affecting bare-metal Intel systems with a permissive performance monitoring configuration on desktop systems.

Without an update, the window remains open.

The question that lingers is not technical — it is strategic. If AI can already hunt zero-days, who else is doing it right now?

Are you confident your kernel is up to date against this?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime