CVE-2026-53362 CrowdStrike LogScale · LogScale

Detect CVE-2026-53362: Linux Kernel Unspecified Vulnerability (KEV) Exploitation Indicators in CrowdStrike LogScale

Detects host-level indicators consistent with exploitation of CVE-2026-53362, an unspecified Linux Kernel vulnerability listed on the CISA KEV catalog (BOD 26-04). Because the upstream fix spans multiple stable kernel commits and no public PoC or precise affected-version range is available, this detection focuses on behavioral signals of local kernel exploitation: unexpected privilege escalation to UID 0, kernel oops/BUG/taint messages coinciding with unprivileged process activity, suspicious loading of kernel modules, and abnormal syscall/capability abuse. Alerts are exposure-and-behavior signals, not proof of the specific bug; correlate with kernel version and patch state.

MITRE ATT&CK

Tactic
Privilege Escalation Execution

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^(bash|sh|dash|python|python3|perl)$/
| UID!=0
| join({#event_simpleName=ProcessRollup2 event_platform=Lin UID=0}, field=[ParentProcessId], include=[FileName, CommandLine, UID], mode=left)
| groupBy([aid, ParentBaseFileName, FileName], function=count())
| sort(_count, order=desc)
high severity medium confidence

CrowdStrike CQL correlating an unprivileged interactive shell process with a subsequently spawned root-UID child on the same Linux host, indicating potential kernel LPE exploitation of CVE-2026-53362.

Data Sources

CrowdStrike FalconLinux sensor telemetry

Required Tables

ProcessRollup2

False Positives & Tuning

  • Sudo/su administrative elevation
  • Privileged automation agents
  • Root service startup from supervisors

Other platforms for CVE-2026-53362

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated non-root to root process transition via setuid helper

    Expected signal: Process launch of /tmp/rootshell with effective UID 0 initiated by user 'nobody'; auditd SYSCALL with euid=0 auid=nobody.

  2. Test 2Kernel taint via unsigned module load (lab)

    Expected signal: Kernel ring buffer module-load message and updated /proc/modules; possible taint flag change.

  3. Test 3Auditd euid escalation event generation

    Expected signal: auditd EXECVE/SYSCALL records tagged cve202653362 showing euid=0 with a non-root auid.

Last updated: 2026-08-28 Research depth: standard
References (9)

Response Playbook

Triage

  1. Identify the affected host's exact running kernel version (`uname -r`) and compare against the fixed stable releases containing the six patch commits; a host running an unpatched kernel plus escalation telemetry is high priority.
  2. Reconstruct the process ancestry of the root-owned child: capture the initiating non-root account, the interpreter used, and the full command lines to determine whether the elevation was legitimate (sudo/su) or anomalous.
  3. Check `dmesg`/journalctl for kernel oops, BUG, WARN, or taint messages timestamped near the escalation event, which often accompany memory-corruption kernel exploits.
  4. Correlate the triggering user account with recent authentication events and determine whether the account is expected to have any interactive root access.

Containment

  1. Isolate the affected host from the network (EDR network containment or switchport ACL) to prevent lateral movement while preserving volatile state.
  2. Suspend or disable the compromised user account and revoke active sessions and SSH keys associated with it.
  3. Prevent loading of untrusted kernel modules on comparable hosts (e.g. set `modules_disabled`, enforce module signing) until patching completes.

Evidence Collection

  1. Capture volatile memory and the full process list (LiME/AVML memory image plus `ps`, `/proc/<pid>` maps) before rebooting, since kernel exploits leave transient artifacts.
  2. Preserve auditd logs, `dmesg` ring buffer, journald, and `/var/log/` for the incident window along with the running kernel image and loaded module list (`lsmod`, `/proc/modules`).

Escalation Criteria

  • !Escalate to IR lead if kernel oops/taint messages coincide with confirmed non-root-to-root escalation on an unpatched kernel.
  • !Escalate if evidence shows loading of an unsigned/unknown kernel module or persistence mechanisms established after the escalation event.
  • !Escalate to the CISA KEV compliance owner given BOD 26-04 remediation timelines if the host cannot be patched within the mandated window.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >auditd SYSCALL/EXECVE records showing euid=0 with a non-root auid
  • >Kernel ring buffer (dmesg) oops/BUG/taint entries
  • >Loaded kernel module list (lsmod / /proc/modules) and module signing state
  • >Process memory maps under /proc/<pid> for the escalated process

Tuning Guidance

Build an allowlist of legitimate privilege-escalation paths (sudo, su, pkexec, known setuid binaries, configuration-management agents, container runtimes) and their expected initiating accounts, then exclude those exe/comm values. Focus alerting on hosts whose kernel version predates the fixed stable releases. If auditd is not deployed, rely on EDR process-ancestry telemetry and add the interpreter-parent + root-child sequence as the primary signal.

Hunting Queries

Baselines non-root-to-root process transitions per host over a 7-day window to surface anomalous escalation clusters that deviate from expected sudo/su patterns.

Hunting — KQL
kql 
DeviceProcessEvents | where Timestamp > ago(7d) | where InitiatingProcessAccountName != "root" and AccountName == "root" | summarize count() by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName | order by count_ desc
Hunting — SPL
spl 
index=linux (sourcetype=linux_audit OR sourcetype=auditd) euid=0 auid!=0 auid!=4294967295 | stats count values(comm) as comm values(exe) as exe by host, auid | sort - count

Atomic Red Team Tests

Test 1 Simulated non-root to root process transition via setuid helper
linux

In a lab, create a root-owned setuid helper and invoke it from an unprivileged shell to generate the non-root-to-root process telemetry this detection keys on (no real exploitation).

Command

bash 
cp /bin/bash /tmp/rootshell && sudo chown root:root /tmp/rootshell && sudo chmod 4755 /tmp/rootshell && sudo -u nobody /tmp/rootshell -p -c 'id'

Cleanup

bash 
sudo rm -f /tmp/rootshell

Expected Telemetry

Process launch of /tmp/rootshell with effective UID 0 initiated by user 'nobody'; auditd SYSCALL with euid=0 auid=nobody.

Expected Detection

Triggers the interpreter-parent to root-child correlation across all seven queries.

Test 2 Kernel taint via unsigned module load (lab)
linux

Load a benign out-of-tree unsigned kernel module to produce kernel taint and module-load telemetry associated with post-exploitation persistence.

Command

bash 
sudo modprobe dummy && dmesg | tail -n 5 && lsmod | grep dummy

Cleanup

bash 
sudo rmmod dummy

Expected Telemetry

Kernel ring buffer module-load message and updated /proc/modules; possible taint flag change.

Expected Detection

Supports forensicArtifacts collection and kernel-module hunting; flagged during evidence review.

Test 3 Auditd euid escalation event generation
linux

Generate an auditd SYSCALL record where a non-root login UID reaches euid 0 through a shell, exercising the SPL/AQL/Sumo parsing logic.

Command

bash 
sudo auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k cve202653362 && su nobody -s /bin/bash -c 'sudo -n id' ; ausearch -k cve202653362 | tail -n 20

Cleanup

bash 
sudo auditctl -d always,exit -F arch=b64 -S execve -F euid=0 -k cve202653362

Expected Telemetry

auditd EXECVE/SYSCALL records tagged cve202653362 showing euid=0 with a non-root auid.

Expected Detection

Matches the auditd-based SPL, QRadar AQL, and Sumo Logic queries.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0002Execution

Related Techniques

T1068Exploitation for Privilege EscalationT1547.006Kernel Modules and Extensions

Same Tactic: Privilege Escalation

Popular Detections