{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others) · updates",
  "home_page_url": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260",
  "feed_url": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260/feed.json",
  "description": "Researcher Hyunwoo Kim (@v4bel) published \"Infinity Core\" on oss-security on Oct 16 2026 after the linux-distros embargo ended: six bugs in the Linux kernel's Timer, Signal, MM, Futex, Scheduler and SLAB code. Five come with public proof-of-concept exploits that take an unprivileged local user to a root shell, and the researcher says they also allow container escape; none needs an unprivileged user namespace. Four of the root exploits were tested on Ubuntu 26.04 (kernel 7.0.0-30-generic) and the scheduler one on Arch Linux (7.2.4-arch1-2). The timer bug, CVE-2026-98260 (a POSIX CPU timer use-after-free when exec() fails in a non-leader thread), also gives full root from an Android untrusted_app on a Samsung Galaxy S26 Ultra; that Android exploit is held back until Samsung ships a fix. The other CVEs are CVE-2026-98256 (sigqueue use-after-free in exec()), CVE-2026-89754 (out-of-bounds write in the page table walk used by mincore()), CVE-2026-80775 (futex private hash use-after-free), CVE-2026-98385 (scheduler cache accounting use-after-free, only with CONFIG_SCHED_CACHE active and multiple LLCs) and CVE-2026-97941 (SLUB list corruption, public trigger only panics the kernel). All are fixed upstream and in stable kernels. Every exploit needs code already running on the machine. Install your distro's kernel update and reboot.",
  "language": "en",
  "_pwn": {
    "slug": "linux-kernel-infinity-core-lpes-cve-2026-98260",
    "severity": "high",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260/feed.xml",
    "llms": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260/llms.txt",
    "json": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260#2026-10-16-8c48d852",
      "url": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260#2026-10-16-8c48d852",
      "title": "Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others): Hyunwoo Kim posts Infinity Core to oss-security after the linux-distros embargo ends and publishes the write-ups and exploits on GitHub: root shells on Ubuntu 26.04 and Arch Linux, container escape, and an Android root exploit for the Galaxy S26 Ultra that stays private until Samsung patches.",
      "content_text": "Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others): Hyunwoo Kim posts Infinity Core to oss-security after the linux-distros embargo ends and publishes the write-ups and exploits on GitHub: root shells on Ubuntu 26.04 and Arch Linux, container escape, and an Android root exploit for the Galaxy S26 Ultra that stays private until Samsung patches.\n\nSource: https://www.openwall.com/lists/oss-security/2026/10/16/36",
      "date_published": "2026-10-16T00:00:00.000Z",
      "external_url": "https://www.openwall.com/lists/oss-security/2026/10/16/36",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260#2026-10-06-21c2847a",
      "url": "https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260#2026-10-06-21c2847a",
      "title": "Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others): The kernel CNA publishes CVE-2026-98260 (\"exec: Cleanup POSIX timers right after de_thread()\") and CVE-2026-98256 (\"signal: Prevent exec() race\"), fixed in 6.18.54 and 7.2.8 (CVE-2026-98260 also in 6.6.158 and 6.12.112).",
      "content_text": "Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others): The kernel CNA publishes CVE-2026-98260 (\"exec: Cleanup POSIX timers right after de_thread()\") and CVE-2026-98256 (\"signal: Prevent exec() race\"), fixed in 6.18.54 and 7.2.8 (CVE-2026-98260 also in 6.6.158 and 6.12.112).\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-98260",
      "date_published": "2026-10-06T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-98260",
      "tags": [
        "high"
      ]
    }
  ]
}