Infinity Core: six kernel root bugs, CloudLinux 9 and 10 already patched

Six bugs in the Linux kernel, collectively named Infinity Core, put every shared server at risk where a customer has shell access or a control panel. Researcher Hyunwoo Kim published technical details and working exploits on oss-security on 16 October 2026, after the embargo deadline agreed with the linux-distros list. CloudLinux published on 21 October at 18:40 UTC the status of its analysis and corrected kernels.

The bug that really concerns CloudLinux is CVE-2026-98260, a use-after-free in POSIX timers for CPUs related to a race condition in exec(). For those running shared hosting, the issue is straightforward: any local account is enough, with no special capabilities, no user namespace, to reach root. CageFS doesn't help: it isolates the filesystem view, but doesn't filter the system calls involved (exec, signals, timers, futex, mincore), so a jailed account can still trigger the bug.

Who is affected and with which kernel

Version	Exposure	Patch status
CloudLinux 9	CVE-2026-98260	Patched kernel: 5.14.0-687.59.1.el9_8
CloudLinux 10	CVE-2026-98260, CVE-2026-98256	Patched kernel: 6.12.0-211.67.1.el10_2
CloudLinux 8 LTS / 9 LTS	CVE-2026-98260 (from code review)	Awaiting TuxCare ELS release
CloudLinux for Ubuntu 22.04	CVE-2026-98260	No Ubuntu patch released yet
CloudLinux 7, 7h, 8	To be verified	Analysis ongoing, no updates required for now

Of the other four bugs in the Infinity Core family, only the one on futex (CVE-2026-80775) is present in CloudLinux 9 and 10 kernels, but it's already patched. The bugs affecting memory management, the scheduler and SLUB allocator don't affect any CloudLinux kernel.

How to verify and update

On CloudLinux 9 and 10, the update is:

dnf update 'kernel*'
reboot

To check if the running kernel already includes the fix:

rpm -q --changelog kernel-core-$(uname -r) | grep -E 'CVE-2026-(98260|98256)'

Those using KernelCare can verify livepatch coverage with:

kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'

The livepatch for the timer bug is in preparation for CloudLinux 9, 10 and Ubuntu kernels; the one for futex is already available.

In the meantime

There is no sysctl or module blacklist to disable the affected code paths. Until the patched kernel or livepatch arrives, it's worth restricting who has local shell access on exposed hosts, separating in distinct VMs tenants that shouldn't trust each other, and monitoring the kernel log: journalctl -k | grep -iE 'BUG:|Oops|general protection'. A clean log doesn't prove nothing happened, because a failed race can simply crash without leaving other traces.