Infinity Core: six Linux kernel flaws with public exploits

Security researcher Hyunwoo Kim disclosed six Linux kernel vulnerabilities, together called "Infinity Core", on the oss-security mailing list on October 16, 2026. Kim says they "can be exploited for Linux server LPE, container escape, and Android LPE." LPE, or local privilege escalation, means a normal user becomes root. Working exploits are already public, so anyone running shared Linux machines or container hosts should update their kernels now.

The six Infinity Core vulnerabilities

The oss-security post lists each bug with its CVE ID, the subsystem it sits in and the commit that fixed it. It gives no version numbers. The fixed kernel versions below come from SecurityOnline, not from Kim's post.

Subsystem	CVE	Bug type	Fixed in (per SecurityOnline)
Timer	CVE-2026-98260	Use-after-free in POSIX CPU timer cleanup	6.6.158, 6.12.112, 6.18.54, 7.2.8
Signal	CVE-2026-98256	Use-after-free in the pending signal queue	6.18.54, 7.2.8
Memory	CVE-2026-89754	Out-of-bounds write in the page-table walker behind mincore()	6.18.50, 7.2.4
Futex	CVE-2026-80775	Use-after-free in the private futex hash setup	6.18.47, 7.1.11, 7.2.1
Scheduler	CVE-2026-98385	Use-after-free in scheduler cache accounting	7.2.9
SLAB	CVE-2026-97941	List corruption in the SLUB memory allocator	7.2.7

Most of these are use-after-free bugs. The kernel frees a piece of memory but keeps using it, and an attacker can refill that memory with data of their choosing. Several also depend on a race, where two operations collide at an exact moment. The timer and signal bugs, for example, are triggered when exec() fails or races in a multi-threaded program. The exec() call replaces a running program with a new one.

SecurityOnline says the timer bug goes back to Linux 5.7, which is why it reaches older long-term kernels. The scheduler and SLAB bugs affect only the 7.2 series, by its account.

How serious they are

Five of the six come with a public proof-of-concept exploit that gives a root shell, according to Kim's GitHub repository and SecurityOnline. The sixth, the SLAB bug, only crashes the kernel so far. "An LPE chain has not yet been written," the repository says.

Kim tested the exploits on Ubuntu 26.04 with kernel 7.0.0-30-generic and on Arch Linux with kernel 7.2.4-arch1-2. The scheduler bug is narrower than the rest. It needs the CONFIG_SCHED_CACHE build option and a runtime setting turned on, and its exploit assumes four virtual CPUs.

SecurityOnline rates four of the bugs High, with a top CVSS score of 7.8, and two still await analysis. It reports no attacks in the wild. None of the six is in CISA's Known Exploited Vulnerabilities catalog, the US list of bugs seen in real attacks.

The research deliberately skipped networking, BPF and bugs that need user namespaces. SecurityOnline argues that a common hardening step, turning off unprivileged user namespaces or BPF, would not block these bugs.

Android phones are in scope

The timer bug also works on Android, Kim's repository says. It gives root on a Samsung Galaxy S26 Ultra from an ordinary app, "with no additional application privileges." Kim is holding back that Android exploit. It will be published once Samsung patches its devices or someone else releases an exploit first. No Samsung advisory or patch date appears in the sources.

How the disclosure happened

Kim reported the bugs privately to linux-distros, the closed list where Linux vendors prepare fixes before a bug goes public. Kim's public post says the embargo agreed with those maintainers has expired. The disclosure landed two days before Linux 7.3 was released on October 18.

What this means for developers

Install your distribution's latest kernel and reboot. A kernel fix does nothing until the machine boots the new kernel. Distributions often backport fixes into their own version numbers. So search your vendor's security notices for the six CVE IDs rather than comparing version numbers with the table above.

Patch the riskiest machines first. A container escape lets code inside one container take over the whole host. That puts Kubernetes nodes, shared build servers and CI runners first in line, especially runners that build pull requests from strangers.

Do not count on disabling user namespaces or BPF as a stopgap. If you run Android test devices, install Samsung's security update when it ships, because the timer bug works from an ordinary app.

The pattern is worth noting too. These bugs sit in core kernel code, such as timers, signals and the memory allocator, which every system runs. Container isolation relies on that shared kernel, so a kernel bug can cross a boundary that looks solid from user space.