Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others)
Linux kernel (timer, signal, mm, futex, scheduler, SLUB)
Researcher Hyunwoo Kim (@v4bel) published "Infinity Core" on oss-security on Oct 16 2026 after the linux-distros embargo ended: six bugs in the Linux kernel's Timer, Signal, MM, Futex, Scheduler and SLAB code. Five come with public proof-of-concept exploits that take an unprivileged local user to a root shell, and the researcher says they also allow container escape; none needs an unprivileged user namespace. Four of the root exploits were tested on Ubuntu 26.04 (kernel 7.0.0-30-generic) and the scheduler one on Arch Linux (7.2.4-arch1-2). The timer bug, CVE-2026-98260 (a POSIX CPU timer use-after-free when exec() fails in a non-leader thread), also gives full root from an Android untrusted_app on a Samsung Galaxy S26 Ultra; that Android exploit is held back until Samsung ships a fix. The other CVEs are CVE-2026-98256 (sigqueue use-after-free in exec()), CVE-2026-89754 (out-of-bounds write in the page table walk used by mincore()), CVE-2026-80775 (futex private hash use-after-free), CVE-2026-98385 (scheduler cache accounting use-after-free, only with CONFIG_SCHED_CACHE active and multiple LLCs) and CVE-2026-97941 (SLUB list corruption, public trigger only panics the kernel). All are fixed upstream and in stable kernels. Every exploit needs code already running on the machine. Install your distro's kernel update and reboot.
Why this severity: Local privilege escalation to root and container escape with public exploits for five of the six bugs; needs local code execution. No known in-the-wild exploitation and not in CISA KEV. Samsung Galaxy devices are still unpatched for CVE-2026-98260, per the researcher.
- Started
- Oct 16, 2026
Affected
- CVE-2026-98260 (timer): stable kernels before 6.6.158, 6.12.112, 6.18.54 and 7.2.8
- CVE-2026-98256 (signal): before 6.18.54 and 7.2.8
- CVE-2026-89754 (mm): before 6.18.50 and 7.2.4
- CVE-2026-80775 (futex): before 6.18.47, 7.1.11 and 7.2.1
- CVE-2026-98385 (scheduler): before 7.2.9
- CVE-2026-97941 (SLUB): before 7.2.7
- Samsung Galaxy S26 Ultra (CVE-2026-98260, Android LPE), no fix yet per the researcher
Fixed in
- 6.6.158
- 6.12.112
- 6.18.54
- 7.2.9
- 7.3
Timeline2
Hyunwoo Kim posts Infinity Core to oss-security after the linux-distros embargo ends and publishes the write-ups and exploits on GitHub: root shells on Ubuntu 26.04 and Arch Linux, container escape, and an Android root exploit for the Galaxy S26 Ultra that stays private until Samsung patches.
The kernel CNA publishes CVE-2026-98260 ("exec: Cleanup POSIX timers right after de_thread()") and CVE-2026-98256 ("signal: Prevent exec() race"), fixed in 6.18.54 and 7.2.8 (CVE-2026-98260 also in 6.6.158 and 6.12.112).
Advisories3
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
