Mitigating Infinity Core (CVE-2026-98260, CVE-2026-98256, CVE-2026-80775, CVE-2026-89754) on Rocky Linux 9, 10, and CIQ Kernel Variants

cve cve-2026-98260 cve-2026-98256 cve-2026-80775 cve-2026-89754 security kernel rocky linux lts mitigation troubleshooting

Arsalan Zaidi
Customer Support Engineer

Oct 16, 2026

Introduction

Infinity Core is a collection of six local privilege escalation (LPE) vulnerabilities in the Linux kernel, disclosed on 2026-10-16. The vulnerabilities target core kernel subsystems (exec, signal handling, futex, and memory management) and can be used for privilege escalation on Linux servers and container escape. Public exploit code is available.

Four of the six CVEs affect CIQ kernel variants:

CVE-2026-98260 (CVSS 3.1: 7.8, Important) is a use-after-free in the exec/POSIX timer subsystem. When exec() fails in a non-leader thread, a race with POSIX CPU timer cleanup produces a UAF on the timer structure.
CVE-2026-98256 (CVSS 3.1: 7.8, Important) is a sigqueue use-after-free caused by a race between exec() in a non-leader thread and cleanup of the private pending signal queue. The freed signal structure can be reused, leading to arbitrary write.
CVE-2026-80775 (CVSS 3.1: 7.0, Important) is a use-after-free in the futex subsystem. Two tasks sharing an mm_struct through nested vfork() calls race to allocate the initial reference counter for FUTEX_PRIVATE_HASH, producing a UAF.
CVE-2026-89754 (CVSS 3.1: 7.0, Important) is an out-of-bounds write in the memory management subsystem. Retry state from the page table walker leaks into an upper level, causing an OOB write to the temporary result buffer used by mincore().

Two additional CVEs from the same disclosure do not affect CIQ kernel variants. CVE-2026-97941 (CVSS 5.5, SLUB list corruption causing kernel panic) and CVE-2026-98385 (CVSS 7.0, scheduler cache UAF requiring CONFIG_SCHED_CACHE) affect only upstream stable kernels. The vulnerable code paths were never present in any CIQ or Rocky Linux kernel branch.

Problem

The four affecting CVEs target core kernel subsystems that are compiled into every kernel configuration. Unlike module-based vulnerabilities where the attack surface can be removed by blocking a kernel module, exec, signal handling, futex, and memory management are fundamental kernel facilities that cannot be disabled. Any system running an affected kernel version is vulnerable to local exploitation.

All four exploits require only local unprivileged access. They do not require any special capabilities, user namespaces, or kernel module loads. The attacks run entirely in userspace via standard syscalls. This makes the attack surface broader than module-dependent CVEs like Dirty Frag or CIFSwitch, where blocking the vulnerable module is a viable interim measure.

Not all four CVEs affect the same kernel versions. The scope per CVE is:

CVE	Subsystem	CVSS	Affected CIQ Variants
CVE-2026-98260	exec/POSIX timers	7.8	LTS 9.2, LTS 9.6, CLK 6.12, CLK 6.18, RLC 9, RLC 10
CVE-2026-98256	exec/signal queue	7.8	CLK 6.18, RLC 10
CVE-2026-80775	futex/vfork	7.0	CLK 6.18, RLC 9, RLC 10
CVE-2026-89754	mm/mincore	7.0	CLK 6.18

Treat the following product variants as affected unless they are running a patched kernel (see Patched Kernels):

RLC Pro LTS 9.2 and 9.6
RLC Pro 9
RLC Pro 10
RLC Pro FIPS variants built on el9 kernels
RLC Pro Hardened variants built on el9 or el10 kernels
CIQ SIG/Cloud Next 9 and 10
CIQ Linux Kernel LT 6.12
CIQ Linux Kernel 6.18

Rocky Linux 8, all el8 LTS variants (8.6, 8.8, 8.10), RLC Pro 8, FIPS 8.x, and CIQ Bridge / CentOS 7 are not affected. The vulnerable code paths were either introduced after the el8 kernel fork point or were never backported into the 4.18 kernel series.

Status

Patched kernels are available for some variants. RLC Pro LTS 9.2, LTS 9.6, and CIQ Linux Kernel 6.18 patched kernels are released and available in Depot. CIQ Linux Kernel LT 6.12, RLC Pro 9, and RLC Pro 10 builds are pending. See the Patched Kernels table below for NVRs and availability.
No kernel-level mitigation available. The four CVEs target built-in kernel subsystems (exec, signal, futex, memory management) that cannot be disabled, blocked, or restricted. There is no sysctl, modprobe override, or configuration change that mitigates these CVEs at the kernel level. The only remediation is installing a patched kernel and rebooting. Operational controls (restricting local access, auditing accounts) can reduce exposure until the patch is applied.
Recommended action: Install the patched kernel for your variant and reboot as soon as the update is available in your configured CIQ repository. Systems with local shell users, CI/CD runners, shared application accounts, or workloads that execute untrusted code should be treated as highest priority.
CIQ Linux Kernel (CLK) variants carry the fixes in their base stable trees. CLK 6.18 includes all four fixes starting at version 6.18.54 and is released in Depot (6.18.56). CLK 6.12 includes the fix starting at version 6.12.112, which is pending release (current Depot version is 6.12.85).
Rocky Linux community releases: CIQ does not publish patched kernels for community Rocky Linux editions. For community release patching status, refer to Rocky Linux Errata.
Open a support case if you need help assessing exposure across your fleet or tracking patched kernel availability for a specific CIQ variant.

Patched Kernels

Variant	Patched Kernel Version	Repo	Released
RLC Pro LTS 9.2	`kernel-5.14.0-284.30.1+43.1.el9_2_ciq`	rlc-9.2-lts.x86_64	2026-10-16
RLC Pro LTS 9.6	`kernel-5.14.0-570.60.1+25.1.el9_6_ciq`	rlc-9.6-lts.x86_64	2026-10-16
RLC Pro 9	`kernel-5.14.0-687.57.1+2.1.el9_8_ciq`	rlc-pro-9.x86_64	Pending
CIQ SIG/Cloud Next 9	`kernel-5.14.0-687.57.1+2.1.el9_8_ciq`	ciq-sigcloud-next-9.x86_64	Pending
CIQ Linux Kernel LT 6.12	`kernel-6.12.112-*` or newer	clk-6.12-el9.x86_64	Pending
CIQ Linux Kernel 6.18	`kernel-clk6.18-6.18.56-1.1.el9_clk` or newer	clk-6.18-el9.x86_64	2026-10-16
RLC Pro 10	`kernel-6.12.0-211.65.1+2.1.el10_2_ciq`	rlc-pro-10.x86_64	Pending
CIQ SIG/Cloud Next 10	`kernel-6.12.0-211.65.1+2.1.el10_2_ciq`	ciq-scn-10.x86_64	Pending

CIQ updates this table as tested kernels become available for each variant.

Confirm what is running on a given system with:

uname -r

If your system reports the patched version above (or newer), the fix is in place.

Installing the Update

RLC Pro LTS and FIPS Variants

For RLC Pro LTS variants (including LTS 9.2 and LTS 9.6) and FIPS variants, the patched kernel is available directly from the configured CIQ repository. No additional repository configuration is required:

sudo dnf update kernel*
sudo reboot

RLC Pro, SIG/Cloud Next, and CIQ Linux Kernel (CLK)

For RLC Pro 9, RLC Pro 10, CIQ SIG/Cloud Next variants, and CIQ Linux Kernel variants, refresh your DNF metadata and update:

sudo dnf clean all && sudo dnf makecache
sudo dnf update kernel*
sudo reboot

For CLK variants, the kernel package name includes the CLK identifier:

sudo dnf update kernel-clk*
sudo reboot

If the update does not appear, confirm that the appropriate depot channel is enabled for your product:

sudo depot enable lts-9.2      # RLC Pro LTS 9.2
sudo depot enable lts-9.6      # RLC Pro LTS 9.6
sudo depot enable rlc-pro-9    # RLC Pro 9 / CIQ SIG Cloud Next 9
sudo depot enable rlc-pro-10   # RLC Pro 10 / CIQ SIG Cloud Next 10

For Rocky Linux community releases, refer to Rocky Linux Errata for patched kernel availability and update instructions.

Verification

After installing the patched kernel and rebooting, confirm the running kernel:

uname -r

The output should match the patched version listed in the Patched Kernels table for your variant.

Resolution

Install the patched kernel for your variant and reboot:

sudo dnf update kernel*
sudo reboot

After rebooting, verify the running kernel matches the patched version:

uname -r

No mitigation was applied for these CVEs, so there is nothing to revert.

Notes

No kernel-level interim mitigation exists. All four CVEs target built-in kernel subsystems that cannot be disabled or restricted. Unlike module-based vulnerabilities (Dirty Frag, CIFSwitch) where blocking a kernel module is effective, the only remediation for Infinity Core is a patched kernel. For systems that cannot be patched immediately, reducing local access exposure is the primary compensating control: restrict SSH access, audit local accounts, and limit workloads that execute untrusted code.
x86_64 exploits, architecture-independent bugs. The published exploit code targets x86_64. The underlying kernel bugs exist on all architectures, so aarch64 and other platforms should also be patched, even though no public aarch64 exploit exists at this time.
Public exploit availability. Working exploits are publicly available. Treat affected systems with local users or untrusted workloads as exploitable now.
Not all CVEs affect all variants. CVE-2026-98260 has the broadest scope (all listed variants). CVE-2026-98256 and CVE-2026-80775 affect only newer kernels (CLK 6.18, RLC 9/10). CVE-2026-89754 affects only CLK 6.18. A single kernel update for each variant covers all applicable CVEs.
el8 is safe. The vulnerable code was either introduced after the el8 kernel fork point or was not backported to the 4.18 kernel series.
Two additional CVEs from the same disclosure (CVE-2026-97941 and CVE-2026-98385) do not affect CIQ products. CVE-2026-97941 is a SLUB list corruption causing kernel panic, and CVE-2026-98385 is a scheduler cache UAF requiring CONFIG_SCHED_CACHE. Neither vulnerable code path is present in any CIQ or Rocky Linux kernel branch.