RESEARCHERS have publicised six Linux kernel vulnerabilities, collectively dubbed “Infinity Core,” with full PoCs that can lead to local privilege escalation and container escape. Hyunwoo Kim’s write-up includes public PoCs for five flaws that reportedly allow a root shell from an unprivileged account, and a sixth that can crash the kernel. Upstream fixes exist, so administrators are urged to apply patched kernels promptly.
The CVEs are CVE-2026-98260 (Timer), CVE-2026-98256 (Signal), CVE-2026-89754 (MM), CVE-2026-80775 (Futex), CVE-2026-98385 (Scheduler), and CVE-2026-97941 (SLAB). Public PoCs reportedly trigger memory-safety flaws via races or edge cases in core kernel components such as timers, memory management, futex, the scheduler, and the SLAB allocator.
Exploitation status indicates no confirmed in-the-wild attacks and none of the CVEs appear in CISA KEV, though all six have public PoCs. Kim tested exploits on Ubuntu 26.04 (kernel 7.0.0-30-generic) and Arch Linux (7.2.4-arch1-2). The fixes are reflected in various stable releases: 98260 patched in 6.6.158, 6.12.112, 6.18.54, 7.2.8; 98256 in 6.18.54 and 7.2.8; 89754 in 6.18.50 and 7.2.4; 80775 in 6.18.47, 7.1.11, 7.2.1; 98385 in 7.2.9; 97941 in 7.2.7.
Practical response emphasises applying the latest kernel updates, especially on multi-tenant hosts and container nodes, and verifying vendor backports. Android users should apply Samsung’s updates when available.