---
title: Infinity Core: public root exploits for five Linux kernel core bugs (timer, signal, mm, futex, scheduler), including container escape; one also roots a Galaxy S26 Ultra | ctxsec
url: https://ctxsec.com/items/linux-infinity-core-six-kernel-lpes-2026-10
description: ""
status: "confirmed (researcher writeup + kernel CVE records); public PoCs; not exploited, not KEV"
published: 2026-10-16
---

> 

[← Cybersecurity News](/news) · [markdown](/items/linux-infinity-core-six-kernel-lpes-2026-10.md)

confirmed (researcher writeup + kernel CVE records); public PoCs; not exploited, not KEV

2026-10-16

### Infinity Core: public root exploits for five Linux kernel core bugs (timer, signal, mm, futex, scheduler), including container escape; one also roots a Galaxy S26 Ultra

Researcher Hyunwoo Kim (@v4bel) published 'Infinity Core' on GitHub on Oct 16, after the linux-distros embargo ended and details went to oss-security. It covers six bugs in core kernel code rather than the usual networking, BPF or user-namespace paths. Five give local privilege escalation and container escape with public PoCs: CVE-2026-98260 (POSIX CPU timer use-after-free in exec(); kernels since 5.7; fixed in 6.6.158, 6.12.112, 6.18.54 and 7.2.8; root shell on Ubuntu 26.04 7.0.0-30-generic), CVE-2026-98256 (sigqueue use-after-free race in exec(); since 6.15; fixed in 6.18.54 and 7.2.8), CVE-2026-89754 (out-of-bounds write in the page-table walker via mincore() racing madvise; fixed in 6.18.50 and 7.2.4), CVE-2026-80775 (futex private-hash use-after-free via prctl(); since 6.17; fixed in 6.18.47, 7.1.11 and 7.2.1; the PoC overwrites the page cache of /usr/bin/passwd) and CVE-2026-98385 (scheduler cache mm_struct use-after-free; 7.2 only; fixed in 7.2.9). The sixth, CVE-2026-97941 (SLUB race), is a kernel panic. The kernel CNA rates the scored ones CVSS 7.8. Kim says CVE-2026-98260 also gives full root on a Samsung Galaxy S26 Ultra from an ordinary app sandbox, and is holding that Android exploit until Samsung patches. All need local code execution, so the biggest exposure is shared hosts, CI runners and container platforms where untrusted users or workloads run code. No in-the-wild use or KEV listing has been reported. Update to your distro's kernel with these fixes and reboot; check your vendor's tracker, since which bugs apply depends on the kernel branch.

Sources: [Infinity Core writeup and PoCs (Hyunwoo Kim, GitHub)](https://github.com/V4bel/InfinityCore) · [CVE-2026-98260 record](https://www.cve.org/CVERecord?id=CVE-2026-98260) · [CVE-2026-98256 record](https://www.cve.org/CVERecord?id=CVE-2026-98256) · [CVE-2026-89754 record](https://www.cve.org/CVERecord?id=CVE-2026-89754) · [CVE-2026-80775 record](https://www.cve.org/CVERecord?id=CVE-2026-80775) · [CVE-2026-98385 record](https://www.cve.org/CVERecord?id=CVE-2026-98385)