A public proof-of-concept exploit, identified as 'ic98260', has been released for the ARM64 platform. The exploit requires an attacker to populate target-specific kernel structure offsets (e.g., TASK_CRED, TASK_CPU_TIMER_HEAD) to gain full root privileges. The vulnerability has been confirmed on the Samsung Galaxy S26 Ultra and allows an attacker to elevate privileges from the untrusted_app domain to root. This issue poses a high risk to users of affected Android devices, as the exploit code provides a functional roadmap for achieving arbitrary kernel memory modification.

Attack Chain

1. Attacker deploys a malicious application to the Android target device with minimal user permissions.
2. The application executes a non-leader thread that triggers a failure during the exec() system call process.
3. The kernel fails to properly release the POSIX CPU timer node, leaving it active in the timerqueue of the task.
4. The application triggers a cleanup routine that forces the kernel to reference the stale timer node pointer.
5. The attacker leverages the resulting use-after-free vulnerability to corrupt adjacent kernel memory structures.
6. The attacker uses memory corruption to overwrite the task structure credentials (task_struct->cred).
7. The process gains elevated root privileges, bypassing Android application sandbox restrictions.

Impact

The vulnerability allows an unprivileged application on the target Android device to achieve full root access. This bypasses the Android security model, enabling the attacker to access sensitive user data, modify system files, and install persistent backdoors. While the exploit requires device-specific kernel structure offsets, the availability of the PoC significantly lowers the barrier for attackers to develop functional exploits for specific hardware models.

Recommendation

Prioritize security patches from the device manufacturer as they become available to address the Infinity Core Timer subsystem vulnerability. Monitor for any suspicious applications attempting to perform kernel memory interaction or privilege escalation attempts using non-standard system calls. Since this vulnerability requires low-privilege access, audit installed applications on enterprise-managed Android devices and restrict installation from untrusted sources.