No impact incident

CloudLinux: Infinity Core (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775): six kernel core bugs with public PoCs, KernelCare status

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Oct 19, 2026, 14:21 UTC
   investigating
   On October 16, 2026 a researcher published six Linux kernel bugs under the name Infinity Core, with public proof-of-concept code for all six oss-security disclosure, PoCs and write-ups. Every bug starts from an ordinary unprivileged local user. Upstream fixes exist for all of them and there are no reports of exploitation in the wild. Five of the PoCs (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, the fifth is for Arch Linux and is outside of scope) give root. They were written and tested on Ubuntu 26.04. On the other distributions only CVE-2026-98260 (POSIX CPU timer use-after-free) is confirmed so far, and only as a kernel crash. Escalation to root there is not ruled out. The other two bugs (CVE-2026-98385, CVE-2026-97941) exist only in kernel 7.2 and later, so no kernel we support carries them. Affected: - Ubuntu 26.04: root with CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775 - AlmaLinux 9 and 10, CloudLinux 9 and 10, Debian 12, Debian 13, Ubuntu 24.04: crash with CVE-2026-98260 - CloudLinux 7, 8 and other distributions: assessment in progress We are also still checking whether CVE-2026-80775 reaches EL9. Mitigation: Debian already ships fixed kernels for CVE-2026-98260: Debian 12 6.1.190-1 (DLA-4841-1), Debian 13 6.12.113-1 (DSA-6568-1). Kernel update plus reboot closes the gap there. For other distros, there are no workarounds that we can recommend currently. Since the bugs sit in exec(), signal, mincore() and futex code that every system uses, there is no module to block and no sysctl that removes the trigger. Fix status: KernelCare livepatches are in preparation. CVE-2026-98260 comes first, on all the affected distributions, then the four root bugs on Ubuntu 26.04. No ETA yet. Once a livepatch is on your feed, apply with: kcarectl --update And verify by running: kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)' This incident will be updated as livepatches reach the testing and main feeds.
2. Oct 19, 2026, 20:52 UTC
   identified
   CVE-2026-80775 (futex) is already livepatched on AlmaLinux 9 and CloudLinux 9. - K20261014_0019, general kernel up to 5.14.0-687.54.1.el9_8, production feed since 2026-10-16 07:20 UTC. Not in the ePortal feed yet. First releases for the remaining CVEs: rough estimate is the test feed on Thursday 2026-10-22 and the production feed on Friday 2026-10-23. This first release covers only part of the exploitable set. Which CVE and distribution pairs it covers is not known yet. Correction: five of the six public PoCs give root, not four. The fifth is CVE-2026-98385 on kernel 7.2. No supported kernel carries it. Vendors: - Red Hat: CVE-2026-98260 affects RHEL 9 and 10. Fixed kernels exist only for some EUS and SAP streams (9.2, 9.4, 9.6, 10.0), not for the general RHEL 9 and 10 kernel yet. - Red Hat: CVE-2026-80775 fixed for RHEL 9 (RHSA-2026:74438), RHEL 10 affected, no fix yet. - Red Hat: CVE-2026-98256 affects RHEL 10. RHEL 9 not affected. - Red Hat: CVE-2026-89754 does not affect RHEL 6 to 10. - Debian fixed CVE-2026-98260: bookworm 6.1.190-1 (DLA-4841-1), trixie 6.12.113-1 (DSA-6568-1). A kernel update plus reboot closes it there. - Ubuntu: CVE-2026-98260 fix pending for 24.04 and 26.04, no fixed kernel yet. Scope changes, not verified by our own tests: - CVE-2026-98256 and CVE-2026-80775 also reach EL10, according to Red Hat. - Our first analysis listed them for Ubuntu 26.04 only. - CVE-2026-89754 is also handled for Debian 13. No report of exploitation in the wild. To check a server: kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
3. Oct 20, 2026, 23:29 UTC
   identified
   CVE-2026-80775 livepatch for AlmaLinux 9 and CloudLinux 9 is now in the ePortal feed. - K20261014_0019, ePortal feed since 2026-10-20 07:13 UTC. Ubuntu 26.04 livepatches for CVE-2026-98260, CVE-2026-98256, CVE-2026-89754 and CVE-2026-80775 are in final review. - Not released yet. CVE-2026-98260 livepatch for EL9 and EL10 is in progress. - Not released yet. Estimate unchanged: first releases in the test feed on Thursday 2026-10-22 and in the production feed on Friday 2026-10-23. Vendors: - Red Hat fixed CVE-2026-98260 and CVE-2026-98256 in the general RHEL 10 kernel: RHSA-2026:85321, kernel 6.12.0-211.67.1.el10_2. RHEL 9 is still without a fix for CVE-2026-98260. - Ubuntu: CVE-2026-98256 and CVE-2026-80775 do not affect 24.04. Fix for 26.04 still pending. No public exploit change. Still no reports of exploitation in the wild. To check a server: kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'
4. Oct 21, 2026, 09:16 UTC
   identified
   We are continuing to work on a fix for this issue.
5. Oct 21, 2026, 09:17 UTC
   identified
   We are continuing to work on a fix for this issue.

Updates as published by CloudLinux (original).