CLN Login📋 TL;DR
Last updated 21 October 2026, 18:40 UTC
Affected: CloudLinux 9, CloudLinux 10, and CloudLinux for Ubuntu 22.04 (timer bug). CloudLinux 8 LTS and 9 LTS by code review. CloudLinux 10 also carries the signal bug. CloudLinux 7, 7h, and 8 are still under analysis.
Mitigation: none reliable.
Fix status:
- CloudLinux 9 and 10: fixed kernels released.
- CloudLinux 9: 5.14.0-687.59.1.el9_8.
- CloudLinux 10: 6.12.0-211.67.1.el10_2.
- CloudLinux 8 LTS and 9 LTS: pending TuxCare ELS release.
- CloudLinux for Ubuntu 22.04: no Ubuntu fix released yet.
- KernelCare: timer livepatch in preparation. Futex livepatch released.
- CloudLinux 7, 7h, 8: analysis in progress; no update needed yet.
Verify: uname -r against the fixed version.
Why it matters: one local account on a shared host is enough.
Infinity Core is a set of six Linux kernel local privilege escalation bugs (CVE-2026-98260, CVE-2026-98256, CVE-2026-89754, CVE-2026-80775, CVE-2026-98385, CVE-2026-97941), published with public exploit code on 16 October 2026.
On CloudLinux, the main exposure is the POSIX CPU timer bug, CVE-2026-98260. Public root exploits exist for other kernels. On CloudLinux 9 and 10, TuxCare reproduced a crash with the timer bug but has not shown root.
Six bugs in core kernel code, one disclosure. A researcher (Kim) published details and exploit code to oss-security on 16 October 2026, after the distribution embargo ended. TuxCare analyzed the six against its supported kernels and published its findings. This advisory applies that analysis to CloudLinux. As of 19 October, TuxCare reported no exploitation in the wild.
Why it matters
“Local” does not mean a customer you trust.
On a hosting server, the local attacker is whoever compromised one of the sites on it. Each of the six bugs is reachable from a plain unprivileged account: no capabilities, no user namespace, no special device access.
The code involved (exec, signals, timers, futexes, mincore()) is used by every process, so no unusual server configuration is needed. Shared servers where customers have SSH or control-panel shells are first in line.
Affected CloudLinux versions
Only the timer and signal bugs reach CloudLinux kernels. The futex bug is present in the CloudLinux 9 and 10 kernels but already fixed there, and its exploitability on CloudLinux 9 is not confirmed. The memory-management bug (CVE-2026-89754) affects no CloudLinux kernel. The scheduler and SLUB bugs (CVE-2026-98385, CVE-2026-97941) exist only in kernel 7.2 and later, which no CloudLinux kernel carries.
| Version | Affected | Status |
|---|---|---|
| CloudLinux 7 (CL7) Kernel 3.10 | ❓ Under analysis | ⏳ Analysis in progress |
| CloudLinux 7h (CL7h) Kernel 4.18 | ❓ Under analysis | ⏳ Analysis in progress |
| CloudLinux 8 (CL8) Kernel 4.18 | ❓ Under analysis | ⏳ Analysis in progress |
| CloudLinux 8 LTS Kernel 5.14 (TuxCare ELS) | ❌ Yes: CVE-2026-98260 (code review) | Kernel: ⏳ pending TuxCare ELS release Livepatch: ⏳ not released |
| CloudLinux 9 (CL9) Kernel 5.14 | ❌ Yes: CVE-2026-98260 | Kernel: ✅ fixed in 5.14.0-687.59.1.el9_8 Livepatch: ⏳ timer patch in preparation |
| CloudLinux 9 LTS Kernel 5.14 (TuxCare ELS) | ❌ Yes: CVE-2026-98260 (code review) | Kernel: ⏳ pending TuxCare ELS release Livepatch: ⏳ not released |
| CloudLinux 10 (CL10) Kernel 6.12 | ❌ Yes: CVE-2026-98260, CVE-2026-98256 | Kernel: ✅ fixed in 6.12.0-211.67.1.el10_2 Livepatch: ⏳ timer patch in preparation |
| CloudLinux for Ubuntu 22.04 Kernel 5.15, HWE 6.8 | ❌ Yes: CVE-2026-98260 | Kernel: ⏳ via Canonical, no fix released † Livepatch: ⏳ not released |
† CloudLinux for Ubuntu runs the stock Ubuntu kernel, so the fix arrives through Ubuntu security updates, not a CloudLinux stream. Ubuntu lists both linux and linux-hwe-6.8 on 22.04 as vulnerable to the timer bug, with no fix released.
“Under analysis” covers one bug only: the timer bug on the 4.18 and 3.10 kernels. The signal, memory-management, futex, scheduler, and SLUB code is absent there. On CloudLinux 8, the timer reproducer did not fire, and the vulnerable ordering has not been confirmed on 4.18.
A KernelCare livepatch will be the no-reboot alternative on the affected versions once the timer patch ships.
Is there a mitigation?
No reliable one.
No sysctl, module blacklist, or switch that disables unprivileged user namespaces touches these code paths. CageFS does not help either: it isolates the file system view, but it does not filter the system calls involved, so a caged user can still trigger the bugs.
The remedy is a fixed kernel and a reboot, or a KernelCare livepatch once released. Until then:
- Limit who has a local shell on exposed hosts.
- Put tenants who do not trust each other in separate virtual machines instead of containers on a shared kernel.
- Watch the kernel log, since a failed race can oops or panic the kernel. A clean log does not prove nothing happened.
journalctl -k | grep -iE 'BUG:|Oops|general protection'Update instructions
Stream 1: CloudLinux kernel (CL7, CL7h, CL8)
Status: 21 October 2026, 18:40 UTC. Analysis is in progress for the timer bug on these kernels. Code review so far finds none of the six vulnerable code paths on CloudLinux 7, and the CloudLinux 7h and 8 kernels share the 4.18 code base. No kernel update is needed yet. This section will be updated when the analysis completes.
Stream 2: CloudLinux 9 and 10 kernel
Status: 21 October 2026, 18:40 UTC. Fixed kernels are released: 5.14.0-687.59.1.el9_8 for CloudLinux 9 and 6.12.0-211.67.1.el10_2 for CloudLinux 10, or later. The futex fix (CVE-2026-80775) came earlier, in 5.14.0-687.54.1.el9_8 and 6.12.0-211.63.1.el10_2.
Install the fixed kernel and reboot:
dnf update 'kernel*'
rebootStream 3: TuxCare ELS LTS kernel
Status: 21 October 2026, 18:40 UTC. CloudLinux 8 LTS (5.14.0-284.1101.el8.tuxcare.11.els13) and CloudLinux 9 LTS (5.14.0-284.1101.el9.tuxcare.7.els20) carry the vulnerable timer code, found by code review and not reproduced. The fixed kernels are pending a TuxCare ELS release. TuxCare’s published analysis does not cover these two versions.
Stream 4: KernelCare livepatch
Status: 21 October 2026, 18:40 UTC. The livepatch for the timer bug (CVE-2026-98260) is in preparation, starting with CloudLinux 9, CloudLinux 10, and the Ubuntu kernels. The futex livepatch (CVE-2026-80775) has been released. You can request patches on demand with kcarectl –update.
How to verify you are patched
For the kernel streams, compare uname -r with the fixed version above, or a later one. Because distribution kernels backport fixes without changing the base version, do not judge exposure from the base kernel number.
On CloudLinux 9 and 10, you can also check that the running kernel carries the fix. Empty output means it is still exposed:
rpm -q --changelog kernel-core-$(uname -r) | grep -E 'CVE-2026-(98260|98256)'With KernelCare, check livepatch coverage:
kcarectl --patch-info | grep -E 'CVE-2026-(98260|98256|89754|80775)'The rest of this advisory is background for readers who want it: how the attack plays out on a shared host, and the six bugs in outline. Neither is required to apply the update above.
Why this matters on a shared host
A typical path starts at the web tier. Someone compromises one WordPress site through a plugin flaw and gets code running as that site’s user. With a working local root exploit, that foothold becomes root on the host, and every account on the server is within reach. Patching changes the ending: a web compromise stays one site to clean up, not a server to rebuild.
On CloudLinux 9 and 10, the root step is a credible risk even though TuxCare has so far shown only a crash: a working root exploit on another kernel means the same bug class can be turned into one. Other platform layers do not remove the exposure.
Technical details of the bugs
All six are memory-safety or race bugs in core kernel code.
| CVE | Area | Bug type | CloudLinux exposure |
|---|---|---|---|
| CVE-2026-98260 | POSIX CPU timers | Use-after-free | CL9, CL10, CL for Ubuntu 22.04; CL8 LTS and CL9 LTS by code review |
| CVE-2026-98256 | Signal delivery | Race condition | CL10, fixed by the vendor |
| CVE-2026-89754 | Memory management (page table walker, mincore()) | Buffer overflow | None |
| CVE-2026-80775 | Futexes | Reference-counting race | Present in CL9 and CL10, already fixed |
| CVE-2026-98385 | Scheduler cache accounting | Use-after-free | None (kernel 7.2 and later only) |
| CVE-2026-97941 | SLUB allocator | ABA race | None (kernel 7.2 and later only) |
Public root exploits exist for the timer, signal, memory-management, and futex bugs on a newer Ubuntu release, and for the scheduler bug on a rolling-release distribution with kernel 7.2. The SLUB bug has only a public trigger that panics the kernel. The 4.18 and 3.10 kernels are under analysis for the timer bug only.
Comments