Race Condition Privilege Escalation in InfinityCore Signal Subsystem (CVE-2026-98256)

CVE-2026-98256 is a high-severity race condition vulnerability affecting the InfinityCore Signal subsystem on Android/ARM64 devices. The flaw originates from improper handling of signal queue cleanup when an exec() operation is invoked by a non-leader thread, causing a conflict with the private pending signal queue of a dying leader thread. This race condition leads to kernel-level memory corruption as a signal entry is linked into a new queue after its parent object has been freed.

The exploitation chain utilizes a surviving signal entry as an oracle to confirm memory reclamation before executing a series of heap-based maneuvers to overwrite kernel credentials. The released exploit proof-of-concept (PoC) automates this process using timing windows and ptrace-based memory manipulation to achieve a root shell. Given the publication of functional exploit code, Android devices utilizing the affected InfinityCore Signal subsystem are at elevated risk of local privilege escalation.

Attack Chain

1. The attacker forks a controller process to orchestrate the race condition across multiple timing windows.
2. The controller forks child processes that invoke exit_group to trigger thread death and initiate signal cleanup.
3. A non-leader thread floods the system with 20,000 per-thread timers against the old leader to force sigqueue event generation.
4. An execveat system call is triggered to induce the race condition during the cleanup of the signal queue.
5. The post-exec process scans the residual pending queue and reclaims freed objects using a ktimer heap spray.
6. The exploit decodes the freelist to identify object addresses and uses a ptrace parent process to perform AIO (Asynchronous I/O) page reclaim.
7. A forged timer is triggered to finalize kernel memory corruption.
8. The exploit overwrites the process credentials in the kernel, resulting in a shell with root privileges.

Impact

Successful exploitation of CVE-2026-98256 results in local privilege escalation, granting an attacker root access to the underlying Android system. This bypasses standard Android security boundaries, allowing for full system compromise, data exfiltration, and the persistence of malicious code at the kernel level. The exploit targets ARM64-based Android kernels and requires local access to the device.

Recommendation

Prioritized actions for security teams:

• Identify all Android devices in the fleet running kernels incorporating the InfinityCore Signal subsystem and verify patching status against vendor security bulletins.
• Prioritize patching for all devices running affected ARM64-based Android kernel builds.
• Implement kernel-level monitoring for suspicious ptrace calls and unusual signal queue activity if telemetry is available.
• Since this is a local privilege escalation (LPE), ensure robust device management policies are in place to restrict unauthorized application installation and sideloading, which could facilitate the deployment of this exploit.