Six vulnerabilities in core Linux kernel code, disclosed together on October 16 under the name Infinity Core, include five whose public exploits take an unprivileged local user to root on the systems they were tested on. According to the researcher, they also allow container escape. Hyunwoo Kim posted the details to the oss-security mailing list once the embargo agreed with Linux distribution maintainers had expired, and published exploit code alongside them.
On a hosting server, CloudLinux notes, the local attacker is whoever has compromised one of the sites on it. Fixed kernels are reaching some distributions now, while others are still pending.
Key facts
- Widest reach: the timer bug, CVE-2026-98260, affects kernels from 5.7 on. Upstream fixed it in 6.6.158, 6.12.112, 6.18.54 and 7.2.8.
- No configuration fix: according to CloudLinux, no sysctl, module blacklist or user namespace switch touches the vulnerable code paths. The remedy is a fixed kernel and a reboot, or a live patch where one exists.
- Fix status: RHEL 9 and 10 with AlmaLinux, Rocky Linux and CloudLinux, plus Debian 12 and 13, have kernels fixed for the timer bug. Ubuntu has not released fixes yet.
- Not zero-days: every fix was upstream before the exploits went public, and TuxCare’s October 20 analysis reports no exploitation in the wild.
Why Shared Servers Are Exposed
CloudLinux’s advisory adds that each of the six bugs can be reached from a plain unprivileged account, without capabilities, user namespaces or special device access, and shared servers where customers have SSH or control panel shells are first in line. The advisory also notes that CloudLinux’s file system isolation layer, CageFS, does not help, because it does not filter the system calls involved.
Six Bugs in the Kernel Core
The flaws sit in core kernel subsystems that Kim describes as having historically seen relatively few security issues: POSIX CPU timers, signal delivery, the page table walker, futexes, scheduler cache accounting and the SLUB memory allocator. Kim’s write-up describes five of them as usable for local privilege escalation and container escape, with public proofs of concept that start from an unprivileged account and gain root. Four were tested on Ubuntu 26.04 and the scheduler bug on Arch Linux with kernel 7.2.4. On other distributions, CloudLinux’s tests of the public exploits have so far confirmed only the timer bug, and only as a kernel crash. CloudLinux does not rule out escalation to root there. The sixth, in SLUB, currently leads to a kernel panic, and the scheduler bug requires a specific configuration and CPU topology. The write-up also notes that it excludes bugs that need a user namespace to trigger.
| CVE | Subsystem | Affected upstream kernels | Fixed upstream in |
|---|---|---|---|
| CVE-2026-98260 | Timer | 5.7 and later | 6.6.158, 6.12.112, 6.18.54, 7.2.8 |
| CVE-2026-98256 | Signal | 6.15 and later | 6.18.54, 7.2.8 |
| CVE-2026-89754 | Memory management | 7.0 and later, plus some 6.18 and 6.19 releases | 6.18.50, 7.2.4 |
| CVE-2026-80775 | Futex | 6.17 and later | 6.18.47, 7.1.11, 7.2.1 |
| CVE-2026-98385 | Scheduler | 7.2 and later | 7.2.9 |
| CVE-2026-97941 | SLUB (kernel panic) | 7.2 and later | 7.2.7 |
The upstream ranges come from the CVE records issued by the kernel’s own CVE team, which were published between September 4 and October 12, before the joint disclosure, and all six are fixed in the 7.3 mainline series. Enterprise distributions backport fixes to older kernel versions, so their kernels are not covered by these ranges and need checking against each vendor’s tracker.
Where the Fixes Stand
On long-lived enterprise kernels, the timer bug is the one that reaches most releases. Its status as listed by each vendor on October 22:
| Distribution | CVE-2026-98260 status | Kernel and advisory |
|---|---|---|
| RHEL 8 | Not affected, according to Red Hat | None needed |
| RHEL 9, AlmaLinux 9, Rocky Linux 9 | Fixed | 5.14.0-687.59.1.el9_8: RHSA-2026:86033 (October 20), ALSA-2026:86033 (October 21), RLSA-2026:86033 (October 22) |
| RHEL 10, AlmaLinux 10, Rocky Linux 10 | Fixed | 6.12.0-211.67.1.el10_2: RHSA-2026:85321 (October 19), ALSA-2026:85321 (October 20), RLSA-2026:85321 (October 21) |
| CloudLinux 9 and 10 | Fixed | Same kernel versions as RHEL 9 and 10 |
| CloudLinux 7, 7h and 8 | Under analysis, according to CloudLinux | No update needed yet |
| CloudLinux 8 LTS and 9 LTS | Affected | Pending a TuxCare ELS release |
| Ubuntu 22.04 LTS | Vulnerable | No fixed version listed for the main kernel. HWE 6.8 kernel fix pending |
| Ubuntu 24.04 LTS | Vulnerable, fix pending | Fix expected in 6.8.0-148.148, not yet released |
| Ubuntu 26.04 LTS | Vulnerable, fix pending | Fix expected in 7.0.0-42.42, not yet released |
| Debian 12 (bookworm) | Fixed | 6.1.190-1, DLA-4841-1 |
| Debian 13 (trixie) | Fixed | 6.12.113-1, DSA-6568-1 |
The other five bugs matter mainly on newer kernels. Red Hat lists RHEL 8 and 9 as not affected by the signal bug and fixed it for RHEL 10 in the same advisory as the timer bug, and it fixed the futex bug for RHEL 9 on October 2 in RHSA-2026:74438. Debian lists bookworm and trixie as not affected by any of the five, and none of the checked stable releases from Red Hat, Ubuntu or Debian is affected by the scheduler and SLUB bugs.
On Ubuntu, three of them reach newer kernels that are still waiting on fixes. The standard 6.8 kernel in Ubuntu 24.04 is not affected by the signal, memory and futex bugs, but the optional HWE 7.0 kernel is affected by all three, with fixes pending, and the HWE 6.17 kernel by the signal and futex bugs, with fixes needed. Ubuntu 26.04 has fixes pending for all three.
A fixed kernel only protects a server once it is running, so the version that uname -r reports is the one to compare against these lists. For machines that cannot reboot right away, CloudLinux reports a KernelCare live patch for the futex bug on AlmaLinux 9 and CloudLinux 9, while one for the timer bug on Enterprise Linux 9 and 10 is still in progress.
Until a fixed kernel is in place, the advisory suggests limiting who has a local shell on exposed hosts, separating tenants who do not trust each other into virtual machines rather than containers on a shared kernel, and watching the kernel log, since a failed race can cause an oops or a panic.
Sources
- Infinity Core: Linux Kernel Core LPEs - oss-security (Openwall)
- Infinity Core: Linux Kernel Core LPEs - GitHub (V4bel)
- Infinity Core Linux Kernel Root Bugs: Status and Kernel Updates for CloudLinux - CloudLinux
- CVE-2026-98260 - Red Hat
- RHSA-2026:86033 - Red Hat
- RHSA-2026:85321 - Red Hat
- ALSA-2026:86033 - AlmaLinux
- RLSA-2026:86033 - Rocky Linux
- CVE-2026-98260 - Ubuntu
- CVE-2026-98260 - Debian Security Tracker
- Infinity Core Proves the Quiet Parts of the Kernel Aren't Safe - TuxCare