Infinity Core: six Linux kernel flaws with public exploits
Security researcher Hyunwoo Kim disclosed six Linux kernel vulnerabilities, together called "Infinity Core", on the oss-security mailing list on October 16, 2026. Kim says they "can be exploited for Linux server LPE, container escape, and Android LPE." LPE, or local privilege escalation, means a normal user becomes root. Working exploits are already public, so anyone running shared Linux machines or container hosts should update their kernels now.
The six Infinity Core vulnerabilities
The oss-security post lists each bug with its CVE ID, the subsystem it sits in and the commit that fixed it. It gives no version numbers. The fixed kernel versions below come from SecurityOnline, not from Kim's post.
| Subsystem | CVE | Bug type | Fixed in (per SecurityOnline) |
|---|---|---|---|
| Timer | CVE-2026-98260 | Use-after-free in POSIX CPU timer cleanup | 6.6.158, 6.12.112, 6.18.54, 7.2.8 |
| Signal | CVE-2026-98256 | Use-after-free in the pending signal queue | 6.18.54, 7.2.8 |
| Memory | CVE-2026-89754 | Out-of-bounds write in the page-table walker behind mincore() | 6.18.50, 7.2.4 |
| Futex | CVE-2026-80775 | Use-after-free in the private futex hash setup | 6.18.47, 7.1.11, 7.2.1 |
| Scheduler | CVE-2026-98385 | Use-after-free in scheduler cache accounting | 7.2.9 |
| SLAB | CVE-2026-97941 | List corruption in the SLUB memory allocator | 7.2.7 |
Most of these are use-after-free bugs. The kernel frees a piece of memory but keeps using it, and an attacker can refill that memory with data of their choosing. Several also depend on a race, where two operations collide at an exact moment. The timer and signal bugs, for example, are triggered when exec() fails or races in a multi-threaded program. The exec() call replaces a running program with a new one.
SecurityOnline says the timer bug goes back to Linux 5.7, which is why it reaches older long-term kernels. The scheduler and SLAB bugs affect only the 7.2 series, by its account.
How serious they are
Five of the six come with a public proof-of-concept exploit that gives a root shell, according to Kim's GitHub repository and SecurityOnline. The sixth, the SLAB bug, only crashes the kernel so far. "An LPE chain has not yet been written," the repository says.
Kim tested the exploits on Ubuntu 26.04 with kernel 7.0.0-30-generic and on Arch Linux with kernel 7.2.4-arch1-2. The scheduler bug is narrower than the rest. It needs the CONFIG_SCHED_CACHE build option and a runtime setting turned on, and its exploit assumes four virtual CPUs.
SecurityOnline rates four of the bugs High, with a top CVSS score of 7.8, and two still await analysis. It reports no attacks in the wild. None of the six is in CISA's Known Exploited Vulnerabilities catalog, the US list of bugs seen in real attacks.
The research deliberately skipped networking, BPF and bugs that need user namespaces. SecurityOnline argues that a common hardening step, turning off unprivileged user namespaces or BPF, would not block these bugs.
Android phones are in scope
The timer bug also works on Android, Kim's repository says. It gives root on a Samsung Galaxy S26 Ultra from an ordinary app, "with no additional application privileges." Kim is holding back that Android exploit. It will be published once Samsung patches its devices or someone else releases an exploit first. No Samsung advisory or patch date appears in the sources.
How the disclosure happened
Kim reported the bugs privately to linux-distros, the closed list where Linux vendors prepare fixes before a bug goes public. Kim's public post says the embargo agreed with those maintainers has expired. The disclosure landed two days before Linux 7.3 was released on October 18.
What this means for developers
Install your distribution's latest kernel and reboot. A kernel fix does nothing until the machine boots the new kernel. Distributions often backport fixes into their own version numbers. So search your vendor's security notices for the six CVE IDs rather than comparing version numbers with the table above.
Patch the riskiest machines first. A container escape lets code inside one container take over the whole host. That puts Kubernetes nodes, shared build servers and CI runners first in line, especially runners that build pull requests from strangers.
Do not count on disabling user namespaces or BPF as a stopgap. If you run Android test devices, install Samsung's security update when it ships, because the timer bug works from an ordinary app.
The pattern is worth noting too. These bugs sit in core kernel code, such as timers, signals and the memory allocator, which every system runs. Container isolation relies on that shared kernel, so a kernel bug can cross a boundary that looks solid from user space.
---
This article was first published on Tech AI Wire.
Also available in
Deutsch · 日本語 · Français · Español · Português
Related on Tech AI Wire
- Linux 7.3 released with fchroot, failfs and faster Btrfs
Sources
- Infinity Core: six Linux kernel vulnerabilities (oss-security post) - oss-security (Openwall)
- Infinity Core: Linux Kernel Core LPEs - GitHub
- Six Linux Kernel Flaws Disclosed With Public PoC Exploits for Root Access and Container Escape - SecurityOnline
5 reactions
Mentions
#Kernel_Security Infinity Core: Linux Kernel Core LPEs V4bel/InfinityCore // The vulns (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, CVE-2026-98385, CVE-2026-97941) covered here affect Kernel Core subsystems that have historically seen relatively few security issues. They enable LPE and container escape on Linux distributions, and some also allow an attacker to gain full root privileges from the Android untrusted_app domain. cyberpocket.org
@mattiasgeniar Maybe just add V4bel/InfinityCore It will be called php2root3seconds combo
Infinity Core: six Linux kernel flaws with public exploits Security researcher Hyunwoo Kim disclosed six Linux kernel vulnerabilities, together called "Infinity Core", on the oss-security mailing list on October 16, 2026. Kim says they "can be exploited for Linux server LPE, container escape, and Android LPE." LPE, or local privilege escalation, means a normal user becomes root. Working exploits are already public, so anyone running shared Linux machines or container hosts should update their kernels now. The six Infinity Core vulnerabilities The oss-security post lists each bug with its CVE ID, the subsystem it sits in and the commit that fixed it. It gives no version numbers. The fixed kernel versions below come from SecurityOnline, not from Kim's post. | Subsystem | CVE | Bug type | Fixed in (per SecurityOnline) | |---|---|---|---| | Timer | CVE-2026-98260 | Use-after-free in POSIX CPU timer cleanup | 6.6.158, 6.12.112, 6.18.54, 7.2.8 | | Signal | CVE-2026-98256 | Use-after-free in the pending signal queue | 6.18.54, 7.2.8 | | Memory | CVE-2026-89754 | Out-of-bounds write in the page-table walker behind mincore() | 6.18.50, 7.2.4 | | Futex | CVE-2026-80775 | Use-after-free in the private futex hash setup | 6.18.47, 7.1.11, 7.2.1 | | Scheduler | CVE-2026-98385 | Use-after-free in scheduler cache accounting | 7.2.9 | | SLAB | CVE-2026-97941 | List corruption in the SLUB memory allocator | 7.2.7 | Most of these are use-after-free bugs. The kernel frees a piece of memory but keeps using it, and an attacker can refill that memory with data of their choosing. Several also depend on a race, where two operations collide at an exact moment. The timer and signal bugs, for example, are triggered when exec() fails or races in a multi-threaded program. The exec() call replaces a running program with a new one. SecurityOnline says the timer bug goes back to Linux 5.7, which is why it reaches older long-term kernels. The scheduler and SLAB bugs affect only the 7.2 series, by its account. How serious they are Five of the six come with a public proof-of-concept exploit that gives a root shell, according to Kim's GitHub repository and SecurityOnline. The sixth, the SLAB bug, only crashes the kernel so far. "An LPE chain has not yet been written," the repository says. Kim tested the exploits on Ubuntu 26.04 with kernel 7.0.0-30-generic and on Arch Linux with kernel 7.2.4-arch1-2. The scheduler bug is narrower than the rest. It needs the CONFIG_SCHED_CACHE build option and a runtime setting turned on, and its exploit assumes four virtual CPUs. SecurityOnline rates four of the bugs High, with a top CVSS score of 7.8, and two still await analysis. It reports no attacks in the wild. None of the six is in CISA's Known Exploited Vulnerabilities catalog, the US list of bugs seen in real attacks. The research deliberately skipped networking, BPF and bugs that need user namespaces. SecurityOnline argues that a common hardening step, turning off unprivileged user namespaces or BPF, would not block these bugs. Android phones are in scope The timer bug also works on Android, Kim's repository says. It gives root on a Samsung Galaxy S26 Ultra from an ordinary app, "with no additional application privileges." Kim is holding back that Android exploit. It will be published once Samsung patches its devices or someone else releases an exploit first. No Samsung advisory or patch date appears in the sources. How the disclosure happened Kim reported the bugs privately to linux-distros, the closed list where Linux vendors prepare fixes before a bug goes public. Kim's public post says the embargo agreed with those maintainers has expired. The disclosure landed two days before Linux 7.3 was released on October 18. What this means for developers Install your distribution's latest kernel and reboot. A kernel fix does nothing until the machine boots the new kernel. Distributions often backport fixes into their own version numbers. So search your vendor's security notices for the six CVE IDs rather than comparing version numbers with the table above. Patch the riskiest machines first. A container escape lets code inside one container take over the whole host. That puts Kubernetes nodes, shared build servers and CI runners first in line, especially runners that build pull requests from strangers. Do not count on disabling user namespaces or BPF as a stopgap. If you run Android test devices, install Samsung's security update when it ships, because the timer bug works from an ordinary app. The pattern is worth noting too. These bugs sit in core kernel code, such as timers, signals and the memory allocator, which every system runs. Container isolation relies on that shared kernel, so a kernel bug can cross a boundary that looks solid from user space. --- This article was first published on Tech AI Wire. Also available in Deutsch · 日本語 · Français · Español · Português Related on Tech AI Wire - Linux 7.3 released with fchroot, failfs and faster Btrfs Sources - Infinity Core: six Linux kernel vulnerabilities (oss-security post) - oss-security (Openwall) - Infinity Core: Linux Kernel Core LPEs - GitHub - Six Linux Kernel Flaws Disclosed With Public PoC Exploits for Root Access and Container Escape - SecurityOnline
你会在虚拟机里跑你不信任的代码吗？ 国内，虚拟机逃逸： mp.weixin.qq.com 海外，虚拟机逃逸： pwn.ai 容器逃逸和安卓 root： V4bel/InfinityCore 最近看到各种 AI 辅助公布虚拟机逃逸，或者容器逃逸的案例，而且几乎覆盖全服务器环境，甚至 vercel 这种云托管也不能保证租户隔离的安全。InfinityCore 这种甚至还能搞安卓 root 。 以前 wannacry 出来的时候大家都说不可信的程序开虚拟机里面跑，但现在不可信的代码哪怕给 AI 去在虚拟机里面运行，都不能保证虚拟机逃逸的案例被 AI 滥用。 我是在想，当我们把不可信代码放进去就安全了，当作一个默认前提时，是不是把信任放错了地方？
6件出てますがRH系で影響あるのは2件と // V4bel/InfinityCore V4bel/InfinityCore
Security researcher V4bel has published Infinity Core, documenting six Linux kernel vulnerabilities that may enable local privilege escalation (LPE) and, in some cases, container escape. V4bel/InfinityCore
Galaxy S26 Ultra: untrusted_app → root. Introducing "Infinity Core": 6 vulns in the Linux kernel's core subsystems. Their impact spans Linux server LPE, container escape, and Android LPE. Details: V4bel/InfinityCore t.co