# Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others) · pwn.watch

> Researcher Hyunwoo Kim (@v4bel) published "Infinity Core" on oss-security on Oct 16 2026 after the linux-distros embargo ended: six bugs in the Linux kernel's Timer, Signal, MM, Futex, Scheduler and SLAB code. Five come with public proof-of-concept exploits that take an unprivileged local user to a root shell, and the researcher says they also allow container escape; none needs an unprivileged user namespace. Four of the root exploits were tested on Ubuntu 26.04 (kernel 7.0.0-30-generic) and the scheduler one on Arch Linux (7.2.4-arch1-2). The timer bug, CVE-2026-98260 (a POSIX CPU timer use-after-free when exec() fails in a non-leader thread), also gives full root from an Android untrusted_app on a Samsung Galaxy S26 Ultra; that Android exploit is held back until Samsung ships a fix. The other CVEs are CVE-2026-98256 (sigqueue use-after-free in exec()), CVE-2026-89754 (out-of-bounds write in the page table walk used by mincore()), CVE-2026-80775 (futex private hash use-after-free), CVE-2026-98385 (scheduler cache accounting use-after-free, only with CONFIG_SCHED_CACHE active and multiple LLCs) and CVE-2026-97941 (SLUB list corruption, public trigger only panics the kernel). All are fixed upstream and in stable kernels. Every exploit needs code already running on the machine. Install your distro's kernel update and reboot.

Page: https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260 · generated 2026-10-30T10:23:38.556Z

## Status
- Severity: high · status: live · patch: partial
- Product: Linux kernel (timer, signal, mm, futex, scheduler, SLUB)
- Started: 2026-10-16
- CVEs: CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, CVE-2026-98385, CVE-2026-97941
- Affected: CVE-2026-98260 (timer): stable kernels before 6.6.158, 6.12.112, 6.18.54 and 7.2.8; CVE-2026-98256 (signal): before 6.18.54 and 7.2.8; CVE-2026-89754 (mm): before 6.18.50 and 7.2.4; CVE-2026-80775 (futex): before 6.18.47, 7.1.11 and 7.2.1; CVE-2026-98385 (scheduler): before 7.2.9; CVE-2026-97941 (SLUB): before 7.2.7; Samsung Galaxy S26 Ultra (CVE-2026-98260, Android LPE), no fix yet per the researcher
- Fixed in: 6.6.158; 6.12.112; 6.18.54; 7.2.9; 7.3

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260/feed.xml
- JSON Feed: https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260.json
- This file: https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260/llms.txt

## Updates (newest first)
- 2026-10-16: Hyunwoo Kim posts Infinity Core to oss-security after the linux-distros embargo ends and publishes the write-ups and exploits on GitHub: root shells on Ubuntu 26.04 and Arch Linux, container escape, and an Android root exploit for the Galaxy S26 Ultra that stays private until Samsung patches. (https://www.openwall.com/lists/oss-security/2026/10/16/36)
- 2026-10-06: The kernel CNA publishes CVE-2026-98260 ("exec: Cleanup POSIX timers right after de_thread()") and CVE-2026-98256 ("signal: Prevent exec() race"), fixed in 6.18.54 and 7.2.8 (CVE-2026-98260 also in 6.6.158 and 6.12.112). (https://www.cve.org/CVERecord?id=CVE-2026-98260)

## Fix brief
# Security brief: Infinity Core: six Linux kernel core bugs with public root exploits and container escapes (CVE-2026-98260 and others)

Source: https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260 · status: live · severity: high · updated Oct 30, 2026, 08:24 UTC

## Patch status
**PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.**

## What it is
Researcher Hyunwoo Kim (@v4bel) published "Infinity Core" on oss-security on Oct 16 2026 after the linux-distros embargo ended: six bugs in the Linux kernel's Timer, Signal, MM, Futex, Scheduler and SLAB code. Five come with public proof-of-concept exploits that take an unprivileged local user to a root shell, and the researcher says they also allow container escape; none needs an unprivileged user namespace. Four of the root exploits were tested on Ubuntu 26.04 (kernel 7.0.0-30-generic) and the scheduler one on Arch Linux (7.2.4-arch1-2). The timer bug, CVE-2026-98260 (a POSIX CPU timer use-after-free when exec() fails in a non-leader thread), also gives full root from an Android untrusted_app on a Samsung Galaxy S26 Ultra; that Android exploit is held back until Samsung ships a fix. The other CVEs are CVE-2026-98256 (sigqueue use-after-free in exec()), CVE-2026-89754 (out-of-bounds write in the page table walk used by mincore()), CVE-2026-80775 (futex private hash use-after-free), CVE-2026-98385 (scheduler cache accounting use-after-free, only with CONFIG_SCHED_CACHE active and multiple LLCs) and CVE-2026-97941 (SLUB list corruption, public trigger only panics the kernel). All are fixed upstream and in stable kernels. Every exploit needs code already running on the machine. Install your distro's kernel update and reboot.

Severity detail: Local privilege escalation to root and container escape with public exploits for five of the six bugs; needs local code execution. No known in-the-wild exploitation and not in CISA KEV. Samsung Galaxy devices are still unpatched for CVE-2026-98260, per the researcher.

- Product: Linux kernel (timer, signal, mm, futex, scheduler, SLUB)
- CVE / advisory ids: CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, CVE-2026-98385, CVE-2026-97941

## Affected versions
- CVE-2026-98260 (timer): stable kernels before 6.6.158, 6.12.112, 6.18.54 and 7.2.8
- CVE-2026-98256 (signal): before 6.18.54 and 7.2.8
- CVE-2026-89754 (mm): before 6.18.50 and 7.2.4
- CVE-2026-80775 (futex): before 6.18.47, 7.1.11 and 7.2.1
- CVE-2026-98385 (scheduler): before 7.2.9
- CVE-2026-97941 (SLUB): before 7.2.7
- Samsung Galaxy S26 Ultra (CVE-2026-98260, Android LPE), no fix yet per the researcher

## Check whether you're affected
Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions:

```sh
uname -r
```

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 6.6.158
- 6.12.112
- 6.18.54
- 7.2.9
- 7.3

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Mitigations
The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Specific notes
Check the running kernel with `uname -r` and compare it with the fixed stable releases for each CVE; install your distro's kernel update and reboot. On shared hosts and container platforms, treat any local code execution as a path to host root until patched. Android: watch Samsung's monthly security bulletin for CVE-2026-98260.

## Latest updates
- Oct 16, 2026: Hyunwoo Kim posts Infinity Core to oss-security after the linux-distros embargo ends and publishes the write-ups and exploits on GitHub: root shells on Ubuntu 26.04 and Arch Linux, container escape, and an Android root exploit for the Galaxy S26 Ultra that stays private until Samsung patches.
- Oct 6, 2026: The kernel CNA publishes CVE-2026-98260 ("exec: Cleanup POSIX timers right after de_thread()") and CVE-2026-98256 ("signal: Prevent exec() race"), fixed in 6.18.54 and 7.2.8 (CVE-2026-98260 also in 6.6.158 and 6.12.112).

## Advisories
- [oss-security: Infinity Core: Linux Kernel Core LPEs](https://www.openwall.com/lists/oss-security/2026/10/16/36) (oss-security)
- [CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread()](https://www.cve.org/CVERecord?id=CVE-2026-98260) (CVE.org (kernel CNA))
- [Linux mainline fix for CVE-2026-98260 (acb03d388181)](https://git.kernel.org/stable/c/acb03d3881818581052924a9bbbe92b8741ed448) (kernel.org)

## Write-ups & news
- [Infinity Core: Linux Kernel Core LPEs (write-ups and PoCs)](https://github.com/V4bel/InfinityCore)
- [Five Linux Kernel Exploits Enable Root and Container Escape](https://linuxsecurity.com/features/what-is-privilege-escalation-linux-kernel)

---
Machine-readable: https://pwn.watch/i/linux-kernel-infinity-core-lpes-cve-2026-98260.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.