Infinity Core: Linux kernel exec timer bug CVE-2026-98260 has a public root PoC

What happened

On 16 October 2026, Hyunwoo Kim (v4bel) posted "Infinity Core" to the oss-security list. It covers six Linux kernel bugs. He reported them to the linux-distros list first and posted once the embargo ended.

CVE-2026-98260 is the timer bug in that set. The Linux kernel CNA had already published the CVE on 6 October 2026, with the fix.

The bug is a use-after-free. A thread that is not the group leader calls exec(). The kernel hands it the leader's ID. If exec() then fails at a late step, the thread exits. A POSIX CPU timer it owned is freed while still queued. Later cleanup touches the freed memory.

Who is affected

Linux kernels from 5.7 are affected until the fixed releases. Fixed upstream versions are 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Distribution kernels may carry the fix under an older version number.

An attacker needs local code execution as an ordinary user. CIQ notes that the exec code is built into every kernel. It cannot be switched off.

What is confirmed

• Score. The kernel CNA scores it CVSS 3.1 7.8 (High). NVD shows that score and has none of its own yet. Red Hat rates it Important. Ubuntu gives it Medium priority.
• Fix. Mainline commit acb03d388181 moves the timer cleanup to right after the ID swap. Stable backports cover the 6.6, 6.12, 6.18 and 7.2 lines.
• Distributions. Debian has fixed kernels for bookworm, trixie and unstable. Red Hat lists RHEL 9 and 10 as affected. It has fixes for some EUS and SAP streams. RHEL 6, 7 and 8 are not affected. Ubuntu had not released fixes on 19 October 2026.
• PoC. Hyunwoo Kim published the Infinity Core repository on GitHub under the account V4bel. It names CVE-2026-98260 and claims a public PoC that turns an unprivileged user into root on Ubuntu 26.04 with kernel 7.0.0-30-generic. ThreatWire has not run it.
• Android claim. The researcher says the bug also gives full root on a Samsung Galaxy S26 Ultra from an ordinary app. He says he will hold that exploit back until Galaxy devices are patched.
• KEV. The CVE is not in the CISA KEV catalog as of 19 October 2026.

What is not known

• Whether anyone exploits it. No source reports attacks.
• When every distribution ships a fix. Status is still changing.
• Whether the Android claim holds. ThreatWire has not tested it, and the exploit is not public.

ThreatWire found no coverage in major security news outlets at the time of writing.

What to do now

1. Patch. Install a kernel with the fix or your vendor's backport.
2. Reboot into it. The fix does nothing until the new kernel runs.
3. Prioritize shared hosts, container hosts and CI runners. These let untrusted users or code run locally.
4. Until you patch, limit who can run code on the host. CIQ says no config switch removes this path.

Sources: the CVE.org record, the kernel fix commit, NVD, the researcher's oss-security post and repository, OSV, GitHub, Positive Technologies, and advisories from Red Hat, Ubuntu, Debian and CIQ. Links are in the references list.