CVE-2026-53264 is a use-after-free race condition in the Linux kernel's network traffic-control subsystem with a CVSS score of 7.8. Concurrent RTM_NEWTFILTER and RTM_DELTFILTER operations can leave one thread reading an action object after another thread has freed it. The exploit requires unprivileged user namespaces, CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER kernel options, and a kernel-specific ROP chain with hardcoded offsets. The exploit creates its own user and network namespaces to obtain namespace-local CAP_NET_ADMIN without host admin rights. It reaches the vulnerable path through a clsact qdisc and flower filter. Timerfd and epoll operations are used to widen the race window, while key payload allocations reclaim the freed object. The ROP chain overwrites core_pattern. The exploit places a copy of itself in a memfd and deliberately crashes a child process, causing Linux to run the memfd-backed binary as the root core-dump handler in the initial namespace. This is a local privilege escalation (LPE) vulnerability, not remote code execution. The exploit achieved a 100% success rate across 10 test runs on CentOS Stream 9, taking between 9 and 111 seconds. Vulnerable kernel versions begin with Linux 4.14. The upstream patch fixes the race by deferring the free operation until existing RCU readers have finished. AI was used to assist with vulnerability discovery, KASAN proof-of-concept production, and race window optimization. The flaw was independently discovered by researcher Lee Jia Jie (STAR Labs) and originally reported by Kyle Zeng (KyleBot).