Infinity Core (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775): six kernel core bugs with public PoCs, KernelCare status

Incident Report for CloudLinux

Identified

CVE-2026-80775 (futex) is already livepatched on AlmaLinux 9 and CloudLinux 9.
- K20261014_0019, general kernel up to 5.14.0-687.54.1.el9_8, production feed since 2026-10-16 07:20 UTC. Not in the ePortal feed yet.

First releases for the remaining CVEs: rough estimate is the test feed on Thursday 2026-10-22 and the production feed on Friday 2026-10-23.
This first release covers only part of the exploitable set. Which CVE and distribution pairs it covers is not known yet.

Correction: five of the six public PoCs give root, not four. The fifth is CVE-2026-98385 on kernel 7.2. No supported kernel carries it.

Vendors:
- Red Hat: CVE-2026-98260 affects RHEL 9 and 10. Fixed kernels exist only for some EUS and SAP streams (9.2, 9.4, 9.6, 10.0), not for the general RHEL 9 and 10 kernel yet.
- Red Hat: CVE-2026-80775 fixed for RHEL 9 (RHSA-2026:74438), RHEL 10 affected, no fix yet.
- Red Hat: CVE-2026-98256 affects RHEL 10. RHEL 9 not affected.
- Red Hat: CVE-2026-89754 does not affect RHEL 6 to 10.
- Debian fixed CVE-2026-98260: bookworm 6.1.190-1 (DLA-4841-1), trixie 6.12.113-1 (DSA-6568-1). A kernel update plus reboot closes it there.
- Ubuntu: CVE-2026-98260 fix pending for 24.04 and 26.04, no fixed kernel yet.

Scope changes, not verified by our own tests:
- CVE-2026-98256 and CVE-2026-80775 also reach EL10, according to Red Hat.
- Our first analysis listed them for Ubuntu 26.04 only.
- CVE-2026-89754 is also handled for Debian 13.
No report of exploitation in the wild.

To check a server:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'

Posted Oct 19, 2026 - 20:52 UTC

Investigating

On October 16, 2026 a researcher published six Linux kernel bugs under the name Infinity Core, with public proof-of-concept code for all six oss-security disclosure, PoCs and write-ups. Every bug starts from an ordinary unprivileged local user. Upstream fixes exist for all of them and there are no reports of exploitation in the wild.

Five of the PoCs (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, the fifth is for Arch Linux and is outside of scope) give root. They were written and tested on Ubuntu 26.04. On the other distributions only CVE-2026-98260 (POSIX CPU timer use-after-free) is confirmed so far, and only as a kernel crash. Escalation to root there is not ruled out. The other two bugs (CVE-2026-98385, CVE-2026-97941) exist only in kernel 7.2 and later, so no kernel we support carries them.

Affected:

- Ubuntu 26.04: root with CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775
- AlmaLinux 9 and 10, CloudLinux 9 and 10, Debian 12, Debian 13, Ubuntu 24.04: crash with CVE-2026-98260
- CloudLinux 7, 8 and other distributions: assessment in progress

We are also still checking whether CVE-2026-80775 reaches EL9.

Mitigation: Debian already ships fixed kernels for CVE-2026-98260: Debian 12 6.1.190-1 (DLA-4841-1), Debian 13 6.12.113-1 (DSA-6568-1). Kernel update plus reboot closes the gap there. For other distros, there are no workarounds that we can recommend currently. Since the bugs sit in exec(), signal, mincore() and futex code that every system uses, there is no module to block and no sysctl that removes the trigger.

Fix status: KernelCare livepatches are in preparation. CVE-2026-98260 comes first, on all the affected distributions, then the four root bugs on Ubuntu 26.04. No ETA yet.

Once a livepatch is on your feed, apply with:
kcarectl --update
And verify by running:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'

This incident will be updated as livepatches reach the testing and main feeds.

Posted Oct 19, 2026 - 14:21 UTC