V4bel / InfinityCore

# Infinity Core: Linux Kernel Core LPEs
# Abstract
This document describes six Linux kernel core vulnerabilities reported and patched by Hyunwoo Kim (@v4bel).
The vulnerabilities covered here affect **Kernel Core** subsystems that have historically seen relatively few security issues. They enable LPE and container escape on Linux distributions, and some also allow an attacker to gain full root privileges from the Android `untrusted_app` domain.
This document excludes areas where vulnerabilities are common, such as networking, sockets, perf, and BPF, as well as bugs that require a user namespace to trigger.
> [!NOTE]
> After these vulnerabilities were reported to linux-distros@vs.openwall.org and the agreed embargo ended, the vulnerability details were posted to oss-security and this Infinity Core document was published.
# Vulnerability Summary
| Subsystem | CVE | Impact | Tested target | Introduced | Fixed |
| --- | --- | --- | --- | --- | --- |
| Timer | CVE-2026-98260 | LPE, Container escape, Android LPE | Ubuntu 26.04 7.0.0-30-generic, Galaxy S26 Ultra S948NKSS4BZIG | 55e8c8eb2c7b | acb03d388181 |
| Signal | CVE-2026-98256 | LPE, Container escape | Ubuntu 26.04 7.0.0-30-generic | fb3bbcfe344e | d2710c8d938a |
| MM | CVE-2026-89754 | LPE, Container escape | Ubuntu 26.04 7.0.0-30-generic | 3b89863c3fa4 | aedf2efd1897 |
| Futex | CVE-2026-80775 | LPE, Container escape | Ubuntu 26.04 7.0.0-30-generic | d9b05321e21e | bde023808364 |
| Scheduler | CVE-2026-98385 | LPE, Container escape | Arch Linux 7.2.4-arch1-2 | df0d98475954 | 28f9c0e0a0b9, b636fef85bda |
| SLAB | CVE-2026-97941 | Kernel panic | Arch Linux 7.2.4-arch1-2 | ba7425312607 | 4a724bcf5d70 |
# Technical Analysis
## Timer (CVE-2026-98260): POSIX CPU timer UAF in exec()
**CVE-2026-98260** is a use-after-free vulnerability in the interaction between `exec()` in a thread other than the leader and POSIX CPU timer cleanup. If `exec()` fails after the TID of a thread with a CPU timer scoped to that thread has been exchanged, the node from the freed timer remains in the timerqueue of a live task. The node is referenced again during later task cleanup, corrupting kernel memory.
The public PoC turns this use-after-free into a full local privilege escalation. Starting as an unprivileged user, it exploits a vulnerable Ubuntu 26.04 `7.0.0-30-generic` system and launches a root shell.
This vulnerability can also be used to gain full root privileges on a **Samsung Galaxy S26 Ultra**, starting from the `untrusted_app` domain with no additional application privileges. The Android exploit will be published once the vulnerability has been patched on Galaxy devices or an unrelated third party has publicly released an exploit. (Android exploit hash: `713a294f72abc46b6e12633117d40e85629ca2b998698fd75c76e523e0d53253`)
For the detailed technical information, see here.
## Signal (CVE-2026-98256): sigqueue UAF in exec()
**CVE-2026-98256** is a use-after-free vulnerability caused by a race between `exec()` in a th