Six Linux kernel flaws enable LPE and container escape

Six vulnerabilities in core Linux kernel subsystems can be turned into local privilege escalation on servers, container escapes, and Android LPE, researcher Hyunwoo Kim reported after an agreed embargo with linux-distros maintainers ended.

Kim calls the set Infinity Core. The bugs sit in the timer, signal, memory-management, futex, scheduler, and SLAB code that ordinary processes and containers routinely touch, which is why the impact reaches multi-tenant hosts and mobile devices as well as conventional servers. Upstream fixes are already in place.

CVE-2026-98260 is a use-after-free in the timer path when an exec() failure in a non-leader thread collides with POSIX CPU timer cleanup.

CVE-2026-98256 is a sigqueue use-after-free from a race between exec() in a non-leader thread and teardown of a private pending signal queue.

CVE-2026-89754 is an out-of-bounds write in memory management: retry state from the page-table walker leaks into an upper level and corrupts the temporary buffer used by mincore().

CVE-2026-80775 is a use-after-free in futex handling when two tasks that share an mm_struct via nested vfork() race to set up the initial reference counter for private hashing.

CVE-2026-98385 is a use-after-free in the scheduler: cache accounting keeps updating per-CPU statistics for an mm_struct that has already been freed. The path requires scheduler cache support, the feature active at runtime, and a CPU topology with more than one last-level cache.

CVE-2026-97941 is list corruption in the SLAB allocator from a race between handing back a freelist and removing a slab from the node partial list during SLUB refill; a public trigger panics the kernel.

Because the affected code is foundational rather than an obscure driver, the disclosures matter for anyone running untrusted workloads, containers, or Android builds that lag upstream.