CVE-2026-53362 Google Chronicle · YARA-L

Detect CVE-2026-53362: Linux Kernel Unspecified Vulnerability (KEV) Exploitation Indicators in Google Chronicle

Detects host-level indicators consistent with exploitation of CVE-2026-53362, an unspecified Linux Kernel vulnerability listed on the CISA KEV catalog (BOD 26-04). Because the upstream fix spans multiple stable kernel commits and no public PoC or precise affected-version range is available, this detection focuses on behavioral signals of local kernel exploitation: unexpected privilege escalation to UID 0, kernel oops/BUG/taint messages coinciding with unprivileged process activity, suspicious loading of kernel modules, and abnormal syscall/capability abuse. Alerts are exposure-and-behavior signals, not proof of the specific bug; correlate with kernel version and patch state.

MITRE ATT&CK

Tactic
Privilege Escalation Execution

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_53362_kernel_lpe {
  meta:
    author = "argus"
    description = "Non-root user achieving root via interactive shell - possible Linux kernel LPE (CVE-2026-53362)"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /.*(bash|sh|dash|python|perl)$/
    $e.principal.user.userid != "root"
    $e.target.user.userid = "root"
  match:
    $e.principal.hostname over 5m
  condition:
    $e
}
high severity medium confidence

Chronicle YARA-L rule matching process launches where an unprivileged user spawns a root-context process from an interactive shell, consistent with kernel privilege-escalation exploitation.

Data Sources

Linux EDR telemetryUDM PROCESS_LAUNCH events

Required Tables

udm.events

False Positives & Tuning

  • Legitimate privilege elevation via sudo/su
  • Service managers launching root daemons
  • Automation and orchestration tooling

Other platforms for CVE-2026-53362

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated non-root to root process transition via setuid helper

    Expected signal: Process launch of /tmp/rootshell with effective UID 0 initiated by user 'nobody'; auditd SYSCALL with euid=0 auid=nobody.

  2. Test 2Kernel taint via unsigned module load (lab)

    Expected signal: Kernel ring buffer module-load message and updated /proc/modules; possible taint flag change.

  3. Test 3Auditd euid escalation event generation

    Expected signal: auditd EXECVE/SYSCALL records tagged cve202653362 showing euid=0 with a non-root auid.

Last updated: 2026-08-28 Research depth: standard
References (9)

Response Playbook

Triage

  1. Identify the affected host's exact running kernel version (`uname -r`) and compare against the fixed stable releases containing the six patch commits; a host running an unpatched kernel plus escalation telemetry is high priority.
  2. Reconstruct the process ancestry of the root-owned child: capture the initiating non-root account, the interpreter used, and the full command lines to determine whether the elevation was legitimate (sudo/su) or anomalous.
  3. Check `dmesg`/journalctl for kernel oops, BUG, WARN, or taint messages timestamped near the escalation event, which often accompany memory-corruption kernel exploits.
  4. Correlate the triggering user account with recent authentication events and determine whether the account is expected to have any interactive root access.

Containment

  1. Isolate the affected host from the network (EDR network containment or switchport ACL) to prevent lateral movement while preserving volatile state.
  2. Suspend or disable the compromised user account and revoke active sessions and SSH keys associated with it.
  3. Prevent loading of untrusted kernel modules on comparable hosts (e.g. set `modules_disabled`, enforce module signing) until patching completes.

Evidence Collection

  1. Capture volatile memory and the full process list (LiME/AVML memory image plus `ps`, `/proc/<pid>` maps) before rebooting, since kernel exploits leave transient artifacts.
  2. Preserve auditd logs, `dmesg` ring buffer, journald, and `/var/log/` for the incident window along with the running kernel image and loaded module list (`lsmod`, `/proc/modules`).

Escalation Criteria

  • !Escalate to IR lead if kernel oops/taint messages coincide with confirmed non-root-to-root escalation on an unpatched kernel.
  • !Escalate if evidence shows loading of an unsigned/unknown kernel module or persistence mechanisms established after the escalation event.
  • !Escalate to the CISA KEV compliance owner given BOD 26-04 remediation timelines if the host cannot be patched within the mandated window.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >auditd SYSCALL/EXECVE records showing euid=0 with a non-root auid
  • >Kernel ring buffer (dmesg) oops/BUG/taint entries
  • >Loaded kernel module list (lsmod / /proc/modules) and module signing state
  • >Process memory maps under /proc/<pid> for the escalated process

Tuning Guidance

Build an allowlist of legitimate privilege-escalation paths (sudo, su, pkexec, known setuid binaries, configuration-management agents, container runtimes) and their expected initiating accounts, then exclude those exe/comm values. Focus alerting on hosts whose kernel version predates the fixed stable releases. If auditd is not deployed, rely on EDR process-ancestry telemetry and add the interpreter-parent + root-child sequence as the primary signal.

Hunting Queries

Baselines non-root-to-root process transitions per host over a 7-day window to surface anomalous escalation clusters that deviate from expected sudo/su patterns.

Hunting — KQL
kql 
DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessAccountName != "root" and AccountName == "root" | summarize count() by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName | order by count_ desc
Hunting — SPL
spl 
index=linux (sourcetype=linux_audit OR sourcetype=auditd) euid=0 auid!=0 auid!=4294967295 | stats count values(comm) as comm values(exe) as exe by host, auid | sort - count

Atomic Red Team Tests

Test 1 Simulated non-root to root process transition via setuid helper
linux

In a lab, create a root-owned setuid helper and invoke it from an unprivileged shell to generate the non-root-to-root process telemetry this detection keys on (no real exploitation).

Command

bash 
cp /bin/bash /tmp/rootshell && sudo chown root:root /tmp/rootshell && sudo chmod 4755 /tmp/rootshell && sudo -u nobody /tmp/rootshell -p -c 'id'

Cleanup

bash 
sudo rm -f /tmp/rootshell

Expected Telemetry

Process launch of /tmp/rootshell with effective UID 0 initiated by user 'nobody'; auditd SYSCALL with euid=0 auid=nobody.

Expected Detection

Triggers the interpreter-parent to root-child correlation across all seven queries.

Test 2 Kernel taint via unsigned module load (lab)
linux

Load a benign out-of-tree unsigned kernel module to produce kernel taint and module-load telemetry associated with post-exploitation persistence.

Command

bash 
sudo modprobe dummy && dmesg | tail -n 5 && lsmod | grep dummy

Cleanup

bash 
sudo rmmod dummy

Expected Telemetry

Kernel ring buffer module-load message and updated /proc/modules; possible taint flag change.

Expected Detection

Supports forensicArtifacts collection and kernel-module hunting; flagged during evidence review.

Test 3 Auditd euid escalation event generation
linux

Generate an auditd SYSCALL record where a non-root login UID reaches euid 0 through a shell, exercising the SPL/AQL/Sumo parsing logic.

Command

bash 
sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k cve202653362 && su nobody -s /bin/bash -c 'sudo -n id' ; ausearch -k cve202653362 | tail -n 20

Cleanup

bash 
sudo auditctl -d always,exit -F arch=b64 -S execve -F euid=0 -k cve202653362

Expected Telemetry

auditd EXECVE/SYSCALL records tagged cve202653362 showing euid=0 with a non-root auid.

Expected Detection

Matches the auditd-based SPL, QRadar AQL, and Sumo Logic queries.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0002Execution

Related Techniques

T1068Exploitation for Privilege EscalationT1547.006Kernel Modules and Extensions

Same Tactic: Privilege Escalation

Popular Detections