- by x32x01 ||
Infinity Core: Six Linux Kernel Vulnerabilities, Including a Root Exploit on Galaxy S26 Ultra
Six vulnerabilities affecting core Linux kernel components have been disclosed by security researcher Hyunwoo Kim (V4bel) under the name Infinity Core.
One of the most significant findings demonstrates a privilege escalation attack on the Samsung Galaxy S26 Ultra, where an application running in Android's restricted <span>untrusted_app</span> domain can gain root privileges without requiring additional application permissions.
The research also highlights security flaws involving CPU timers, signal handling, memory management, synchronization, process scheduling, and the SLUB memory allocator.
These findings matter because Linux powers far more than desktop computers. It also runs servers, cloud infrastructure, containers, embedded systems, and the Android kernel.
Let's examine how each vulnerability works, what an attacker could potentially achieve, and what Linux and Android users should do to protect their systems.
The vulnerabilities affect different kernel subsystems, but several share a particularly dangerous characteristic: improper memory management.
The Linux kernel operates with higher privileges than ordinary applications. It manages system memory, schedules processes, handles hardware interactions, and enforces security boundaries.
When an attacker successfully exploits a kernel vulnerability, they may be able to bypass those boundaries and gain privileges that would normally be unavailable to their application.
This is known as Local Privilege Escalation (LPE).
Depending on the vulnerability and exploitation conditions, the consequences can include:
This vulnerability involves improper memory management during a specific execution path associated with the
The problem occurs when a kernel object is released from memory while another internal structure still maintains a reference to it.
If the kernel subsequently accesses that reference, it may interact with memory that has already been freed.
This condition is called a Use-After-Free (UAF) vulnerability.
Why is it dangerous?
Freed memory can potentially be reused for another object. If an attacker can influence how that memory is reused, the stale reference may provide an opportunity to corrupt kernel memory or manipulate execution.
Demonstrated impact:
The researcher demonstrated that this vulnerability could be exploited for privilege escalation on Linux.
More notably, the published research includes an exploitation scenario targeting the Samsung Galaxy S26 Ultra.
In that scenario, an application operating within Android's
This makes CVE-2026-98260 one of the most significant findings in the Infinity Core research.
Linux uses signals to notify processes about events such as termination requests, exceptions, and other operating system conditions.
This vulnerability involves a synchronization problem during the cleanup of pending signals.
Multiple execution paths may interact with the same internal signal structures. Under specific timing conditions, a race can occur while those structures are being cleaned up.
As a result, a memory object may be released even though another part of the kernel still maintains a reference to it.
This creates another Use-After-Free condition.
Potential security impact:
An attacker who successfully controls the relevant race conditions may be able to manipulate kernel memory and exploit the vulnerability for local privilege escalation.
The underlying issue demonstrates why proper synchronization is essential when multiple kernel execution paths access shared data.
This vulnerability involves the
The system call allows a process to determine whether pages belonging to a specified memory range are currently resident in physical memory.
Internally, the kernel must examine memory mappings and navigate different levels of page tables.
The vulnerability originates from an error in the retry logic used during this process.
Under specific conditions, the kernel may process a memory range more than once.
This can cause data to be written beyond the intended buffer boundaries, potentially corrupting adjacent kernel memory.
The issue is an example of an Out-of-Bounds Write (OOB Write).
Why does this matter?
Kernel memory corruption can affect critical internal structures. Depending on the affected memory and exploitation conditions, an attacker may be able to turn an ordinary memory-handling error into a serious security vulnerability.
FUTEX stands for Fast Userspace Mutex.
It is a Linux mechanism used to coordinate synchronization between threads and processes, particularly when they need controlled access to shared resources.
This vulnerability involves a race condition between operations that share the same memory space.
The race affects internal reference management and can result in memory being released while it is still in use.
That creates a Use-After-Free condition within the kernel.
Demonstrated impact:
The published exploitation research shows that this flaw can be turned into a Linux privilege escalation attack.
The finding highlights how synchronization mechanisms designed to coordinate concurrent operations can themselves become attack surfaces when reference management fails.
The Linux scheduler determines when processes and threads receive CPU execution time.
To make scheduling decisions, it maintains internal information about running tasks and their execution behavior.
CVE-2026-98385 involves a condition where part of the scheduler continues updating statistics associated with a memory structure that has already been released.
If that memory is subsequently reused, the scheduler may write into memory belonging to another object.
This creates a potentially exploitable memory corruption condition.
Important limitation:
The exploitation scenario depends on specific kernel configuration requirements and CPU topology conditions.
Therefore, the vulnerability should not be interpreted as automatically exploitable on every Linux installation.
Its practical impact depends on the affected kernel build and the environment in which it runs.
SLUB is a memory allocator used by the Linux kernel to efficiently manage allocations for frequently used kernel objects.
This vulnerability involves a race condition affecting internal allocator lists.
Under certain circumstances, the race can corrupt the relationships between list elements.
The resulting corruption may cause the allocator to access an invalid pointer during a subsequent memory allocation operation.
Demonstrated impact:
The published proof of concept demonstrates a Kernel Panic, which causes the operating system kernel to crash.
Unlike some of the other Infinity Core findings, the project does not include a completed privilege escalation exploit for this particular vulnerability.
That distinction is important: demonstrating a kernel crash does not automatically establish that an attacker can obtain root privileges.
CVE-2026-98260
Several findings demonstrate how vulnerabilities in fundamental operating system components can potentially compromise security boundaries.
Three areas deserve particular attention.
Ordinary applications operate within restricted security domains.
The Galaxy S26 Ultra exploitation scenario demonstrates how a kernel vulnerability can undermine those restrictions, potentially allowing an untrusted application to reach root privileges.
This does not mean every Galaxy S26 Ultra is vulnerable. Actual exposure depends on its kernel version, security patch level, and other exploitation requirements.
A successful local privilege escalation attack could allow an attacker who already has limited execution access to compromise higher-privileged parts of the operating system.
This makes timely kernel security updates particularly important for shared infrastructure.
However, unlike traditional virtual machines, Linux containers share the host operating system's kernel.
A kernel vulnerability may therefore create an opportunity to cross isolation boundaries under suitable exploitation conditions.
A successful container escape could allow an attacker to interact with resources outside the compromised container.
Not every vulnerability in Infinity Core automatically enables container escape, but the shared-kernel architecture makes this an important security consideration.
For Linux administrators:
To display additional kernel and system information:
Important: A kernel version number alone cannot reliably establish whether a system is vulnerable. Linux distributions frequently backport security fixes without changing the kernel's main version number.
Always consult your distribution's official security advisories.
For Android users:
The six vulnerabilities affect different kernel subsystems, but their underlying lessons are closely related: improper memory handling, race conditions, and invalid references can undermine critical operating system protections.
The Galaxy S26 Ultra exploitation scenario is particularly notable because it demonstrates how an application running with restricted privileges can potentially compromise the kernel itself.
For Linux administrators and Android users, the priority is straightforward: monitor official security advisories, identify affected kernel builds, and apply the appropriate updates as they become available.
Security researchers should also treat each finding individually, distinguishing demonstrated privilege escalation from memory corruption, configuration-dependent exploitation, and denial-of-service outcomes.
Six vulnerabilities affecting core Linux kernel components have been disclosed by security researcher Hyunwoo Kim (V4bel) under the name Infinity Core.
One of the most significant findings demonstrates a privilege escalation attack on the Samsung Galaxy S26 Ultra, where an application running in Android's restricted <span>untrusted_app</span> domain can gain root privileges without requiring additional application permissions.
The research also highlights security flaws involving CPU timers, signal handling, memory management, synchronization, process scheduling, and the SLUB memory allocator.
These findings matter because Linux powers far more than desktop computers. It also runs servers, cloud infrastructure, containers, embedded systems, and the Android kernel.
Let's examine how each vulnerability works, what an attacker could potentially achieve, and what Linux and Android users should do to protect their systems.
🔍 What Is Infinity Core?
Infinity Core is a collection of six Linux kernel vulnerabilities disclosed by security researcher Hyunwoo Kim, also known as V4bel.The vulnerabilities affect different kernel subsystems, but several share a particularly dangerous characteristic: improper memory management.
The Linux kernel operates with higher privileges than ordinary applications. It manages system memory, schedules processes, handles hardware interactions, and enforces security boundaries.
When an attacker successfully exploits a kernel vulnerability, they may be able to bypass those boundaries and gain privileges that would normally be unavailable to their application.
This is known as Local Privilege Escalation (LPE).
Depending on the vulnerability and exploitation conditions, the consequences can include:
- Gaining root privileges from a restricted user account.
- Bypassing operating system security restrictions.
- Escaping an isolated container.
- Corrupting kernel memory.
- Triggering a system crash or Kernel Panic.
🧩 The Six Infinity Core Linux Kernel Vulnerabilities
The research identifies six vulnerabilities affecting different parts of the Linux kernel.1. CVE-2026-98260: CPU Timer Use-After-Free
Affected component: Linux CPU timersThis vulnerability involves improper memory management during a specific execution path associated with the
exec() operation.The problem occurs when a kernel object is released from memory while another internal structure still maintains a reference to it.
If the kernel subsequently accesses that reference, it may interact with memory that has already been freed.
This condition is called a Use-After-Free (UAF) vulnerability.
Why is it dangerous?
Freed memory can potentially be reused for another object. If an attacker can influence how that memory is reused, the stale reference may provide an opportunity to corrupt kernel memory or manipulate execution.
Demonstrated impact:
The researcher demonstrated that this vulnerability could be exploited for privilege escalation on Linux.
More notably, the published research includes an exploitation scenario targeting the Samsung Galaxy S26 Ultra.
In that scenario, an application operating within Android's
untrusted_app security domain successfully reaches root privileges without requiring additional application permissions.This makes CVE-2026-98260 one of the most significant findings in the Infinity Core research.
2. CVE-2026-98256: Signal Handling Race Condition
Affected component: Linux signal handlingLinux uses signals to notify processes about events such as termination requests, exceptions, and other operating system conditions.
This vulnerability involves a synchronization problem during the cleanup of pending signals.
Multiple execution paths may interact with the same internal signal structures. Under specific timing conditions, a race can occur while those structures are being cleaned up.
As a result, a memory object may be released even though another part of the kernel still maintains a reference to it.
This creates another Use-After-Free condition.
Potential security impact:
An attacker who successfully controls the relevant race conditions may be able to manipulate kernel memory and exploit the vulnerability for local privilege escalation.
The underlying issue demonstrates why proper synchronization is essential when multiple kernel execution paths access shared data.
3. CVE-2026-89754: Memory Management Buffer Overflow
Affected component: Linux memory managementThis vulnerability involves the
mincore() system call.The system call allows a process to determine whether pages belonging to a specified memory range are currently resident in physical memory.
Internally, the kernel must examine memory mappings and navigate different levels of page tables.
The vulnerability originates from an error in the retry logic used during this process.
Under specific conditions, the kernel may process a memory range more than once.
This can cause data to be written beyond the intended buffer boundaries, potentially corrupting adjacent kernel memory.
The issue is an example of an Out-of-Bounds Write (OOB Write).
Why does this matter?
Kernel memory corruption can affect critical internal structures. Depending on the affected memory and exploitation conditions, an attacker may be able to turn an ordinary memory-handling error into a serious security vulnerability.
4. CVE-2026-80775: FUTEX Race Condition
Affected component: Linux FUTEX synchronizationFUTEX stands for Fast Userspace Mutex.
It is a Linux mechanism used to coordinate synchronization between threads and processes, particularly when they need controlled access to shared resources.
This vulnerability involves a race condition between operations that share the same memory space.
The race affects internal reference management and can result in memory being released while it is still in use.
That creates a Use-After-Free condition within the kernel.
Demonstrated impact:
The published exploitation research shows that this flaw can be turned into a Linux privilege escalation attack.
The finding highlights how synchronization mechanisms designed to coordinate concurrent operations can themselves become attack surfaces when reference management fails.
5. CVE-2026-98385: Linux Scheduler Use-After-Free
Affected component: Linux CPU schedulerThe Linux scheduler determines when processes and threads receive CPU execution time.
To make scheduling decisions, it maintains internal information about running tasks and their execution behavior.
CVE-2026-98385 involves a condition where part of the scheduler continues updating statistics associated with a memory structure that has already been released.
If that memory is subsequently reused, the scheduler may write into memory belonging to another object.
This creates a potentially exploitable memory corruption condition.
Important limitation:
The exploitation scenario depends on specific kernel configuration requirements and CPU topology conditions.
Therefore, the vulnerability should not be interpreted as automatically exploitable on every Linux installation.
Its practical impact depends on the affected kernel build and the environment in which it runs.
6. CVE-2026-97941: SLUB Allocator Race Condition
Affected component: Linux SLUB memory allocatorSLUB is a memory allocator used by the Linux kernel to efficiently manage allocations for frequently used kernel objects.
This vulnerability involves a race condition affecting internal allocator lists.
Under certain circumstances, the race can corrupt the relationships between list elements.
The resulting corruption may cause the allocator to access an invalid pointer during a subsequent memory allocation operation.
Demonstrated impact:
The published proof of concept demonstrates a Kernel Panic, which causes the operating system kernel to crash.
Unlike some of the other Infinity Core findings, the project does not include a completed privilege escalation exploit for this particular vulnerability.
That distinction is important: demonstrating a kernel crash does not automatically establish that an attacker can obtain root privileges.
📊 Infinity Core Vulnerabilities at a Glance
The following overview summarizes the affected components and the technical issues described in the research.CVE-2026-98260
- Component: CPU timers
- Issue: Use-After-Free
- Demonstrated impact: Privilege escalation, including a Galaxy S26 Ultra root exploit.
- Component: Signal handling
- Issue: Race condition and Use-After-Free
- Impact: Kernel memory manipulation and privilege escalation.
- Component: Memory management
- Issue: Out-of-Bounds Write
- Impact: Kernel memory corruption.
- Component: FUTEX
- Issue: Race condition and improper reference management
- Demonstrated impact: Linux privilege escalation.
- Component: CPU scheduler
- Issue: Use-After-Free
- Impact: Memory corruption under specific configuration conditions.
- Component: SLUB allocator
- Issue: Race condition and list corruption
- Demonstrated impact: Kernel Panic.
⚠️ Why These Linux Kernel Vulnerabilities Matter
The significance of Infinity Core extends beyond individual memory corruption bugs.Several findings demonstrate how vulnerabilities in fundamental operating system components can potentially compromise security boundaries.
Three areas deserve particular attention.
Android Root Privilege Escalation
Android relies on the Linux kernel while implementing additional security mechanisms, including application sandboxing and SELinux restrictions.Ordinary applications operate within restricted security domains.
The Galaxy S26 Ultra exploitation scenario demonstrates how a kernel vulnerability can undermine those restrictions, potentially allowing an untrusted application to reach root privileges.
This does not mean every Galaxy S26 Ultra is vulnerable. Actual exposure depends on its kernel version, security patch level, and other exploitation requirements.
Linux Server Security
Linux servers frequently execute multiple applications and services with different privilege levels.A successful local privilege escalation attack could allow an attacker who already has limited execution access to compromise higher-privileged parts of the operating system.
This makes timely kernel security updates particularly important for shared infrastructure.
Container Escape Risks
Containers provide isolated environments for running applications and services.However, unlike traditional virtual machines, Linux containers share the host operating system's kernel.
A kernel vulnerability may therefore create an opportunity to cross isolation boundaries under suitable exploitation conditions.
A successful container escape could allow an attacker to interact with resources outside the compromised container.
Not every vulnerability in Infinity Core automatically enables container escape, but the shared-kernel architecture makes this an important security consideration.
🛡️ How to Protect Linux and Android Systems
The most effective response is to identify affected systems and install the appropriate vendor-provided security fixes.For Linux administrators:
- Check the currently installed kernel version.
- Review security advisories published by your Linux distribution.
- Identify whether your kernel build is affected by the reported CVEs.
- Install the relevant kernel security updates.
- Reboot when required to activate the updated kernel.
- Verify that the system is running the intended patched version.
Bash:
uname -r Bash:
uname -aAlways consult your distribution's official security advisories.
For Android users:
- Install official Android security updates when available.
- Check for device-specific firmware updates.
- Avoid installing applications from untrusted sources.
- Keep Google Play Protect enabled.
- Review the security patch level reported in device settings.
❓ Frequently Asked Questions
-----------------------Can Infinity Core vulnerabilities give an attacker root access?
Some of the disclosed vulnerabilities have demonstrated privilege escalation capabilities. CVE-2026-98260 notably includes a root exploitation scenario involving the Samsung Galaxy S26 Ultra. However, the demonstrated impact differs between vulnerabilities.Does Infinity Core affect every Linux distribution?
No. Exposure depends on the kernel version, distribution-specific patches, configuration, and individual vulnerability requirements.Can an Android application exploit a Linux kernel vulnerability?
Yes. Android applications normally operate within restricted security environments, but a successfully exploited kernel vulnerability may allow an application to bypass those restrictions.Is a Kernel Panic the same as gaining root access?
No. A Kernel Panic causes the operating system kernel to crash. Root privilege escalation gives an attacker elevated system permissions. These are different security outcomes.Final Thoughts
Infinity Core highlights how subtle memory management and synchronization errors inside the Linux kernel can lead to serious security consequences.The six vulnerabilities affect different kernel subsystems, but their underlying lessons are closely related: improper memory handling, race conditions, and invalid references can undermine critical operating system protections.
The Galaxy S26 Ultra exploitation scenario is particularly notable because it demonstrates how an application running with restricted privileges can potentially compromise the kernel itself.
For Linux administrators and Android users, the priority is straightforward: monitor official security advisories, identify affected kernel builds, and apply the appropriate updates as they become available.
Security researchers should also treat each finding individually, distinguishing demonstrated privilege escalation from memory corruption, configuration-dependent exploitation, and denial-of-service outcomes.
Last edited: