Infinity Core: six privilege escalation vulnerabilities in the Linux kernel

What happened and what to do

On 16 October 2026, Hyunwoo Kim published the "Infinity Core" report on the oss-sec list. It describes a set of six vulnerabilities in Linux kernel subsystems: Timer, Signal, MM, Futex, Scheduler and SLAB. According to the author, the embargo agreed with the linux-distros maintainers had expired, which is why the report was published. The flaws can be exploited for local privilege escalation on Linux servers, for container escape, and for local privilege escalation on Android devices.

For a company, the case calls for immediate action on three fronts. The first is inventory: mapping which servers, container images, Kubernetes nodes and Android devices in the fleet run affected kernel versions. A collector can consolidate kernel and package versions and cross them with distribution and vendor advisories. The second is remediation: prioritizing patch rollout by the exposure of each asset, starting with multi-user hosts, environments running third-party workloads, and containers sharing the host kernel. The third is detection: monitoring for signs of local exploitation, such as unexpected privilege elevation and anomalous kernel calls, through runtime telemetry with alerts feeding the incident response process.

How the consultancy can help

Assessment of fleet exposure to Infinity Core, with a kernel version inventory across servers, containers and Android devices. Then design of a collection pipeline that cross-checks vendor advisories, patch prioritization, and runtime monitoring deployed and operated in the client's environment.

Next step

If your company runs Linux on servers, containers or an Android fleet, send a short description of your environment and the workloads it runs. We will then prepare a scoped proposal for the inventory, patch prioritization and monitoring work.