Infinity Core Linux Kernel LPEs and Which Distro Kernels Are Affected

TL;DR

---

Hyunwoo Kim (V4bel), who also found Dirty Frag, published six Linux kernel vulnerabilities under the name Infinity Core.
Five of them are local privilege escalations (LPE), meaning a user who can already run code on the machine without special rights can become root.
After the embargo with the linux-distros mailing list ended (an agreement to hold details until fixes are ready), the oss-security post and the InfinityCore repository on GitHub went public at 1:00 AM JST on October 17.

Copy Fail and Dirty Frag, which I covered earlier, were reached through peripheral features such as the crypto API and IPsec.
The Infinity Core README explicitly excludes areas where bugs are common, such as networking, sockets, perf, and BPF, as well as bugs that need a user namespace to trigger.
What remains is timers, signals, memory management, futex, the scheduler, and the slab allocator, all part of the kernel core.

The six bugs and when they were introduced

I took the introduced and fixed versions for each CVE from the announcements by the Linux kernel CVE Team, which assigns CVE numbers for the Linux kernel.
The Linux kernel runs a mainline (upstream) branch that takes new features alongside several stable branches, such as 6.6 and 6.12, that only keep receiving fixes.
Porting an upstream change to an older branch is called a backport, and bugs can reach older branches the same way fixes do.
In the table, “Introduced” is the mainline version that first contained the buggy commit, and “Upstream fixed” lists the fix release in each stable branch.

A UAF (use-after-free) is a bug where code keeps a pointer to freed memory and uses it later. If an attacker can place other data in the freed region, the kernel reads and writes that data as if it were a legitimate structure, which can lead to overwriting credentials.

CVE	Area	Type	Demonstrated impact	Introduced	Upstream fixed
CVE-2026-98260	Timer	UAF	Root, container escape, Android root	5.7	6.6.158, 6.12.112, 6.18.54, 7.2.8
CVE-2026-98256	Signal	UAF	Root, container escape	6.15	6.18.54, 7.2.8
CVE-2026-89754	MM	Out-of-bounds write	Root, container escape	7.0	6.18.50, 7.2.4
CVE-2026-80775	Futex	UAF	Root, container escape	6.17	6.18.47, 7.1.11, 7.2.1
CVE-2026-98385	Scheduler	UAF	Root and container escape on specific configurations	7.2	7.2.9
CVE-2026-97941	SLAB	List corruption	Kernel panic	7.2	7.2.7

The MM bug was introduced in 7.0, but it was also backported into the stable 6.18 branch from 6.18.21 through 6.18.49, and into the 6.19 branch from 6.19.11 onward.

The CVE announcements came out before the oss-security post.
Futex was announced on September 4, SLAB on September 25, Timer and Signal on October 6, and Scheduler on October 12. During the embargo, only the fix commits and CVEs were public, and exploitation details were withheld.

Comparing the “Introduced” column against upstream versions, only the Timer bug reaches older branches.
That said, when a distro backports a newer feature into an older branch, the bug can show up in kernels older than this table suggests.
The Scheduler and SLAB code arrived upstream in 7.2, so going by the upstream table, they affect rolling-release distros on 7.2 such as Arch Linux, or systems running a self-installed newer kernel.
The README’s test targets match this: Timer, Signal, MM, and Futex on Ubuntu 26.04 7.0.0-30-generic, and Scheduler and SLAB on Arch Linux 7.2.4-arch1-2.

Status in major distros

I checked each distro’s security tracker on October 22.
Distro kernel version numbers don’t line up with upstream, so the table copies each vendor’s own verdict.
Ubuntu’s HWE (hardware enablement) kernels are newer kernels offered to an LTS release later for newer hardware. Because they use a newer branch than the stock kernel, the set of affected CVEs differs too.

DSA and DLA are Debian security advisory IDs, and RHSA is Red Hat’s. Each announces the release of fixed packages.
kernel-rt is RHEL’s real-time kernel, shipped as a separate package from the regular kernel, so its fix status is tracked separately.

Distro	Affected CVEs	Status as of October 22
Ubuntu 26.04 LTS	Timer, Signal, MM, Futex	All fixes in progress, none shipped
Ubuntu 24.04 LTS	Timer (plus MM on the 7.0 HWE kernel)	Fix in progress, not shipped
Ubuntu 22.04 LTS	Timer	Not shipped
Ubuntu 20.04 LTS	None on the stock 5.4 kernel. Timer on the 5.15 HWE kernel	Not shipped for the 5.15 HWE kernel
Ubuntu 18.04 LTS and older	None	Not affected
Debian 13 trixie	Timer	Fixed in 6.12.113-1 (DSA-6568-1)
Debian 12 bookworm	Timer	Fixed in 6.1.190-1 (DLA-4841-1)
RHEL 9	Timer, Futex	kernel: Timer fixed in 5.14.0-687.59.1.el9_8 (RHSA-2026:86033), Futex fixed in 5.14.0-687.54.1.el9_8. kernel-rt: Timer and Futex unfixed
RHEL 10	Timer, Signal, Futex	Timer and Signal fixed in 6.12.0-211.67.1.el10_2 (RHSA-2026:85321). Futex unfixed
RHEL 7, 8	None	Not affected

On Ubuntu’s pages for CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, and CVE-2026-80775, the main 26.04 LTS kernel package linux is listed as “Vulnerable, work in progress” for all four.
The README also lists an unpatched Ubuntu 26.04 kernel, 7.0.0-30-generic, as the test target for the PoC (proof-of-concept code that shows the bug can be exploited).
On 24.04 LTS, the stock 6.8 kernel only gets the Timer bug, but installing the 7.0 HWE kernel adds MM.

On Debian’s security tracker, Timer is fixed for bookworm and trixie, and Signal, MM, and Futex are marked “Vulnerable code not present.”
The upstream CVE announcement doesn’t list a fix for the 6.1 branch, but Debian backported the fix to bookworm on its own.

For Red Hat, I checked the pages for CVE-2026-98260, CVE-2026-98256, and CVE-2026-80775.
According to Red Hat’s data, MM, Scheduler, and SLAB don’t affect RHEL 7 through 10.
The Futex bug was introduced upstream in 6.17, yet RHEL 9’s 5.14.0 kernel is listed as affected.
RHEL 10’s 6.12.0 kernel is also affected by Signal (upstream 6.15) and Futex (upstream 6.17).
The vulnerable code most likely came along when Red Hat backported newer features into its own kernels.
Comparing the uname -r number against the upstream table tells you neither whether you’re affected nor whether you’re fixed.

How the PoCs work

The README names the overwrite target for three of them: MM, Futex, and Scheduler.
MM overwrites the process credentials directly. Futex and Scheduler overwrite the page cache of a setuid binary, a program that runs with its owner’s privileges (usually root) no matter who launches it.
The page cache is the in-memory copy of file contents that Linux keeps. Once it’s modified, the next execution of that program runs the modified contents.

CVE	How the PoC gets root
Timer	Root shell from an unprivileged user on Ubuntu 26.04. On the Galaxy S26 Ultra, root from the regular app sandbox untrusted_app
Signal	Detects when a freed signal queue entry has been reused, then gets a root shell through the path that dequeues a crafted queue
MM	Places a struct cred right after the mincore() temporary buffer and overwrites the UID and GID with 0
Futex	Reclaims the freed hash with a pipe ring, modifies a pipe_buffer flag, and overwrites the page cache of /usr/bin/passwd
Scheduler	Corrupts the futex hash reference counter with a stale statistics write, then overwrites the page cache of /usr/bin/newgrp the same way as Futex

struct cred is the kernel structure that holds a process’s UID and GID. Once those are 0, the kernel treats the process as root.
In the final step, Futex and Scheduler modify a pipe_buffer flag to write into the page cache, the same as Dirty Pipe.
The bugs themselves are UAFs in core kernel code, but for these two, the last step to root is the same page cache corruption seen in earlier bugs.

Timer

When a non-leader thread (any thread other than the first one in the process) calls exec(), de_thread() hands that thread the old leader’s PID.
If exec() then fails and the task exits, the per-thread CPU timer is freed, but its node stays in a live task’s timer queue.
Later, the task cleanup path touches that node again and writes to freed memory.

The fix moves POSIX timer cleanup to right after de_thread(), so it completes before exec() can fail and the task exits.
The buggy commit dates back to 5.7, the oldest of the six.

V4bel is holding back the Android exploit for the Galaxy S26 Ultra privilege escalation, and the README only lists the file’s hash.
The README says it will be published once Galaxy devices are patched or once an unrelated third party releases an exploit.

Signal

This one also starts with exec() in a non-leader thread.
The path that flushes the dying old leader’s pending signal list without a lock and the path that follows the inherited PID to queue a signal on the new leader operate on the same sigqueue at the same time.
The fix forbids queuing private signals to a task that is exiting, and flushes the pending queue immediately in exit_signals().

MM (memory management)

mincore() is a system call that reports, one byte per page, whether pages in a given memory range are resident in physical memory.
If a race with madvise(MADV_DONTNEED) removes a page table, the lower-level walker returns without clearing its “retry” state, and the upper level reads that as a request to walk the same range again.
The result cursor has already advanced, so the walk writes past the one-page temporary buffer into adjacent kernel memory.

Futex

futex is the kernel feature that user-space locks are built on, and prctl() lets a process set the size of its own private futex hash.
When two tasks sharing the same address space through nested vfork() allocate the first reference counter at the same time, the counter written first drops out of tracking.
The hash gets freed while still in use, and a leftover pointer can write into freed memory.

Scheduler

The scheduler cache statistics added in 7.2 embedded the statistics in the task’s address space structure (mm_struct).
Even after exec() on another CPU swaps the address space and frees the old statistics, the scheduler keeps writing through the address it saved.

According to the README, the vulnerable path requires all of the following.

Condition	Details
Build config	CONFIG_SCHED_CACHE=y
Runtime	sched_cache_active enabled
CPU topology	The domain sharing the LLC (last-level cache) has more than one CPU and a wider parent domain
sysctl	sysctl_sched_cache_user is nonzero

The public PoC assumes a 4-vCPU topology where CPUs 0 and 1 share one LLC and CPUs 2 and 3 share another.

SLAB (SLUB allocator)

“SLAB” in the README is the name of the slab allocator category, and SLUB is the implementation current Linux uses.
SLUB is the memory allocator for small kernel objects. It carves same-sized objects out of page-sized groups called slabs.
The optimistic freelist return added in 7.2 compared only the freelist and counters with cmpxchg. Meanwhile another CPU could free and reallocate an object so the slab came back to the same state, and the check missed the change (an ABA problem).
The same list node ends up linked twice, and the list is corrupted.

The public code only triggers the race repeatedly with System V messages to cause a kernel panic. There is no PoC that chains it to root.

Impact on containers and Android

Containers share the kernel with the host, so a kernel privilege escalation can turn directly into privileges on the host.
The README says container escape was demonstrated for all five bugs other than SLAB.
That covers environments where other people’s code runs on the same kernel as the host, such as Kubernetes worker nodes, CI build runners, and shared servers with multiple users logging in.

On the other hand, all six require the ability to run code locally.
An attacker who already got code execution on the server through another bug, such as a web application flaw, would use these to raise privileges.
None of the six are in the October 21 version of the CISA KEV catalog (the list of vulnerabilities with confirmed exploitation in the wild).

Only the Timer bug was demonstrated on Android, where the README says it got root on a Galaxy S26 Ultra from regular app privileges with no extra permissions.
The README doesn’t say whether other devices or the other CVEs work on Android.

Workarounds and checking after the update

Dirty Frag had a workaround of blocking the ESP and RxRPC modules from loading.
Infinity Core targets core features such as timers, signals, futex, and memory management, so they can’t be disabled the same way.
Disabling BPF or user namespaces doesn’t help either, since the README picked bugs that don’t use them in the first place.

The Scheduler bug is the only one a setting can rule out: a build with CONFIG_SCHED_CACHE disabled, or a system that doesn’t meet the runtime conditions above, never reaches the vulnerable path.
The Scheduler and SLAB code isn’t in kernels older than 7.2 at all.
For everything else, the fix is to install your distro’s patched kernel and reboot.
Updating the package means nothing if the old kernel keeps running, so after rebooting, check the kernel that actually booted with uname -r.